Sub-Botnet Coordination Using Tokens in a Switched Network

Botnets have evolved to incorporate peer-to-peer communication for the purpose of better hiding the administrative source of the botnet. Current botnet detection mechanisms identify network traffic patterns at strategic locations within a network such as the gateway. As detection techniques improve, botnet design will continue to evolve to evade detection; thus, it is advantageous to identify potential future botnet models for the purpose of developing defense mechanisms before an actual new attack type is seen in the wild. This paper presents a model for coordinating external communication among bots located within the same switched network. This model prevents a gateway-based monitor from correlating external communication dialogs as the internal source of the communication is not a single bot-host. Future phases of this project include developing efficient techniques for mitigating this potential future botnet model.