Hao Zhiyu

Botnet spoofing: fighting botnet with itself

A botnet consists of a network of compromised computers connected to the Internet that is controlled by a remote attacker (botmaster) via command and control (C&C) channels. Botnets are the root cause of many Internet attacks such as Email spam, extortion through DDoS, seeding malware, and online identity theft etc. Recently, the arms race between botmasters and defenders has become increasingly common. Defenders have successfully shut down many well-known botnets such as Rustock, Mariposa, Waledac, Stuxnet, Coreflood, and Kelihos by exploiting their C&C design flaws. However, these countermeasures also stimulate the botnets to be more resilient. For security-conscious Internet users, the hostbased security software (i.e., anti-virus and firewall) could provide effective protection against the botnet attacks; however, the remaining security-unconscious users will suffer from the botnet attacks and be compromised easily. Consequently, how to protect both security-conscious and security-unconscious users against advanced botnets (without any C&C vulnerability) has posed a great challenge to this day. In this paper, we propose the idea of botnet spoofing which aims at addressing the above challenge to some degree. We define botnet spoofing as a technique which could trick a malicious bot to spread BotSpoofer instead of spreading itself. BotSpoofer is defined as a computer program which implements botnet spoofing technique.