Descriptive model of peer-to-peer Botnet structures

Abstract

Peer-to-peer (P2P) Botnets, which are more resilient and robust than centralized botnets, have emerged as the peer-to-peer technology evolves. Better understanding of this new phenomenon will help researchers develop detection and mitigation methods. Most of existing work is case study of typical P2P botnets. In this paper, we focus on systematically analyzing structures of P2P botnets. We propose a descriptive model of P2P botnet structures, which consists of features of P2P bot, definitions of structures, and structural properties. Firstly, we detail two key functionalities of P2P bot, command-and-control (C&C) functionality and peer-to-peer (P2P) functionality, and give several features of P2P bot. And then, we define two structures of P2P botnets: C&C structure and P2P structure. To characterize these structures, we propose several properties and corresponding quantitative methods. Finally, we conduct experiments to verify our results.