Measuring Peer-to-Peer Botnets Using Control Flow Stability

Currently, botnets use peer-to-peer (P2P) networks for command and control (C&C) communication. In contrast to traditional centralized-organized botnets, P2P-based botnets do not have a central point of failure for botnets and are consequently more concealable and robust, which degrades the performance of botnet detection approaches significantly. Considering that the C&C flows related to a P2P-based bot exhibit stability on statistical meaning due to the impartial position in botnet and performing pre-programmed control activities automatically, a novel detection approach based on the control flow stability is proposed in this paper. The measurement of control flow stability is firstly derived from the P2P-based C&C case study and the definition of control flow stability. After analyzing the stability of Storm bots and comparing the results to that of normal P2P client, a stability detection algorithm that can tune the accuracy of detecting results is developed. Extensive experimental results show the proposed approach is very efficient and can detect P2P-based botnet with low false positive ratio.