Method and system for detecting and reducing botnet activity

[0001] A botnet is a large collection of compromised computers controlled by a command structure including a master computer operated by an individual or group of individuals commonly known as a bot-master or a bot-herder. The command structure may also include additional computers, commonly known as command and control servers, for disseminating instructions from the bot-master. The compromised computers in the botnet, commonly known as drones or zombies, are used by the botnet command structure to stage various malicious and/or illegal activities including, for example, sending SPAM, launching denial-of-service attacks, scanning networks for vulnerability, stealing information, propagating computer viruses, and the like.

[0002] In order to receive updated or current instructions, compromised computer drones typically contact the command and control servers to receive instructions from the bot-master. The traffic associated with such communication is low in volume and can be difficult to distinguish from normal, good traffic emanating from the compromised computer.

[0008] While the concepts of the present disclosure are susceptible to various modifications and alternative forms, specific exemplary embodiments thereof have been shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit the concepts of the present disclosure to the particular forms disclosed, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention as defined by the appended claims.

[0009] In the following description, numerous specific details such as logic implementations, opcodes, means to specify operands, resource partitioning/sharing/duplication implementations, types and interrelationships of system components, and logic partitioning/integration choices are set forth in order to provide a more thorough understanding of the present disclosure. It will be appreciated, however, by one skilled in the art that embodiments of the disclosure may be practiced without such specific details. In other instances, control structures, gate level circuits and full software instruction sequences have not been shown in detail in order not to obscure the invention. Those of ordinary skill in the art, with the included descriptions, will be able to implement appropriate functionality without undue experimentation.

[0010] References in the specification to “one embodiment”, “an embodiment”, “an example embodiment”, etc., indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to effect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

[0011] Embodiments of the invention may be implemented in hardware, firmware, software, or any combination thereof. Embodiments of the invention implemented in a computer system may include one or more bus-based interconnects between components and/or one or more point-to-point interconnects between components. Embodiments of the invention may also be implemented as instructions stored on a machine-readable medium, which may be read and executed by one or more processors. A machine-readable medium may include any mechanism for storing or transmitting information in a form readable by a machine (e.g., a computing device). For example, a machine-readable medium may include read only memory (ROM); random access memory (RAM); magnetic disk storage media; optical storage media; flash memory devices; and others.

[0012] Referring now to FIG. 1, a computer network system 100 includes a computing device 102, a plurality of remote computers 104, and a network 106. The computing device 102 may communicate with any one of the remote computers 104 over the network 106. The computing device 102 is communicatively coupled to the network 106 via a communication link 108. Similarly, the remote computers 104 are communicatively coupled to the network 106 via communication links 110. The communication links 108, 110 may be embodied as any type and number of communication links capable of facilitating communication between the computers 102, 104 and the network 106. For example, the communication links 108, 110 may be embodied as or otherwise include any number of wires, cables, wireless connections, and/or other interconnect. The network 106 may be embodied as or otherwise include any type of network including a local area network (LAN), a wide area network (WAN), or a publicly-accessible, global network such as the Internet. Additionally, the network 106 may include any number of intervening communication links and devices such as routers, switches, hubs, and other intervening computers.

[0013] If a botnet is active in the computer network system 100, the system 100 may also include one or more botnet servers 112. The botnet servers 112 are communicatively coupled to the network 106 via communication links 114, which may be similar to the communication links 108, 110. The botnet server 112 may be embodied as a botnet master, a botnet command and control server, or a previously compromised remote computer. As such, the destination address of the botnet server 112 is considered an unsafe destination address. However, the destination addresses of the remote computers 104 may be considered safe destination addresses.

[0014] In the illustrative embodiment of FIG. 1, the computing device 102 includes a processor 120, a chipset 122, and a plurality of peripheral devices 124. The computing device 102 may be embodied as any type of computing device such as, for example, a desktop computer system, a laptop computer system, or a handheld computing device. The illustrative processor 120 is a single core processor. However, in other embodiments, the processor 120 may be embodied as a multi-processor having any number of processor cores. Additionally, the client computer 102 may include additional processors having one or more processor cores.

[0015] The processor 120 is communicatively coupled to the chipset 122 via a number of signal paths 126. The signal paths 126 may be embodied as any type of signal paths capable of facilitating communication between the processor 120 and the chipset 122. For example, the signal paths 126 may be embodied as any number of wires, printed circuit board traces, via, bus, intervening devices, and/or the like. The chipset 122 may include a memory controller hub (MCH) or northbridge, an input/output controller hub (ICH) or southbridge, and a firmware device. In such embodiments, the firmware device may be embodied as a memory storage device for storing Basic Input/Output System (BIOS) data and/or instructions and/or other information.

[0016] The chipset 122 is communicatively coupled to a memory device 128 via a number of signal paths 130. Similar to the signal paths 126, the signal paths 130 may be embodied as any type of signal paths capable of facilitating communication between the chipset 122 and the memory device 128 such as, for example, any number of wires, printed circuit board traces, via, bus, intervening devices, and/or the like. The memory devices 128 may be embodied as dynamic random access memory devices (DRAM), synchronous dynamic random access memory devices (SDRAM), double-data rate dynamic random access memory device (DDR SDRAM), and/or other volatile memory devices. Additionally, although only a single memory device is illustrated in FIG. 1, in other embodiments, the client computer 102 may include additional memory devices.

[0017] The chipset 122 is also communicatively coupled to the plurality of peripheral devices 124 via signal paths 132. Again, similar to the signal paths 126, 130, the signal paths 132 may be embodied as any type of signal paths capable of facilitating communication between the chipset 122 and the peripheral devices 124 such as, for example, any number of wires, printed circuit board traces, via, bus, intervening devices, and/or the like. The peripheral devices 124 may include any number of peripheral devices including data storage devices, interfaces, and output devices. For example, as illustrated in FIG. 1, the peripheral devices may include a network interface 134 configured to facilitate communication between the client computer 102 and the network 106. Additionally, the peripheral devices 124 may include any number of other devices such as, for example, a keyboard, a display, a hard disk, a mouse, and/or the like. The particular devices included in the peripheral devices 124 may depend upon, for example, the intended use of the computing device. Further, it should be appreciated that the client computer 102 may include other components, sub-components, and devices not illustrated in FIG. 1 for clarity of the description.

[0018] Referring now to FIG. 2, a method 200 for detecting and reducing botnet activity may be executed by the computing device 102. The method 200 begins with block 202 in which a training stage is performed by the computing device 102. Once the training stage is complete, the computing device 102 performs a detection stage in block 204.

[0019] One embodiment of a method 300 for performing the training stage of method 200 is illustrated in FIG. 3. The method 300 begins with block 302 in which the computing device 102 determines whether any outgoing traffic has been initiated. The outgoing traffic may be initiated by a request from a user of the computing device 102. For example, the user may navigate to a particular web site. If outgoing traffic has been initiated, the computing device 102 determines whether the destination is a new destination in block 304. To do so, the computing device 102 may analyze the destination address of the requested destination and compare the destination address to a list of previously identified destination addresses. The destination addresses may be embodied as any type of address that identifies a specific remote computer. For example, in one embodiment, the destination addresses are embodied as Internet Protocol (IP) addresses. However, in other embodiments the destination address may be embodied as Uniform Resource Locators (URLs) or the like.

[0020] If the requested destination is determined to be a new destination, a persistence value, p(d), for the new destination, d, is initialized in block 306. The persistence value is indicative of how often a particular destination is connected to or otherwise requested for a given time period. For example, in one embodiment, the persistence value for a particular destination is defined as the ratio of the number of time periods during which the computing device 102 connected to or otherwise requested connection to the particular destination over the total number of time periods being monitored. Such time periods define separate tracking windows. Each tracking window corresponds to a period of time during which connection to the destination address is monitored. The collection of tracking windows define an observation window, which corresponds to the period of time over which the persistence value is determined.

[0021] For example, in one embodiment, the observation window may be set to a value of twenty-four hours. That is, the observation window corresponds to a period of time equal to twenty-four hours. As discussed above, the observation window is formed from a number of smaller tracking windows, each of which correspond to an equal period of time. For example, the tracking windows may be set to a value of two hours. That is, each tracking window corresponds to a period of time equal to two hours. As such, the observation window of twenty-four hours includes twelve separate tracking windows of two hours each. In such embodiments, the persistence value for a particular destination would be equal to the number of tracking windows in which the particular destination was connected to over the total number of tracking windows in the particular observation window. For example, if the particular destination was connected to or otherwise requested at least once in two of the tracking windows, the current persistence value, p(d), for the current observation window would be equal to 2/12 or about 0.167. In some embodiments, the observation window is a sliding window. That is, for every new tracking window (i.e., period of time) entered into, the oldest tracking window is discarded.

[0022] It should be appreciated that the accuracy of the detection method may be increased by using multiple observation windows. In such embodiments, the observation windows are equal to different periods of time. Each observation window may include a different number of tracking windows equal to different periods of time relative to other observation windows. By using multiple observation windows of varying sizes, the overall granularity of observation is increased thereby increasing the likelihood of detecting persistent communication with a particular destination. In embodiments wherein multiple observation windows are used, the persistence value for the destination may be equal to a weighted combination of the determined persistence values of the set of observation windows. For example, in some embodiments, the persistence value for the destination may be equal to the average persistence value of the set of observation windows. Alternatively, in other embodiments, the persistence value of particular observation windows (e.g., windows that have been determined to be significant in some way) may be weighted greater than other observation windows in the calculation of the overall persistence value of the destination. Additionally, in one particular embodiment, the persistence value for the destination is equal to the highest persistence value of the set of observation windows.

[0023] Referring back to the method 300, the persistence value, p(d), for each observation window is initialized in block 306. The particular number of observation windows, length of such windows, and number and length of associated tracking windows may be predetermined and stored in the computer device 102. If so, such data is subsequently retrieved from storage when required. In the illustrative embodiment, the observation windows and tracking windows are the same for each destination address. However, in other embodiments, the number and size of the observation windows and tracking windows may be randomly determined or determined based on some criteria such as the destination address itself. Additionally, it should be appreciated that, in some embodiments, the number of observation windows, length of such windows, and/or number and length of associated tracking windows may be adjusted “on the fly” or over time based on conditions of the computing environment, historical performance, user behavior, and/or other criteria. For example, in some embodiments, the number of observation windows, length of such windows, and/or number and length of associated tracking windows may be adjusted based on the conceived threat level. That is, when the threat level is determined to be high, more observation windows may be used.

[0024] Referring now back to block 304, if the destination is not new, the persistence value for the requested destination is updated in block 308. That is, the persistence value associated with each observation window is updated in block 308. To do so, the numerator of the persistence value is increased by one if the computing device 102 has not yet connected to the particular destination in the current tracking window of each observation window. As such, the persistence values associated with some observation windows may change while the persistence values associated with other observation windows remain the same depending on the length of the tracking windows associated with each observation window.

[0025] In block 310, the computing device 102 determines if the persistence value for the requested destination is greater than a threshold value. As discussed above, the persistence value for the requested destination is equal to the greatest persistence value of the set of observation windows being used. The threshold value may be predetermined and stored in the computing device 102. A lesser threshold value corresponds to greater security and a greater threshold value corresponds to lesser security. In one embodiment, the threshold value is a value in the range of about 0.5 to about 0.7. In one particular embodiment, the threshold value is about 0.6.

[0026] If the current persistence value for the requested destination is less than the threshold value, the method 300 loops back to block 302. However, if the current persistence value is greater than the threshold value, the requested destination address is added to a whitelist. The whitelist is embodied as a list of known safe destination addresses. Because the computing device 102 is in the training stage, any destination that is continually connected to is deemed to be a safe destination that is regularly visited. For example, the destination may correspond to a news site, a business site, or a community site. After the requested destination has been added to the whitelist, the method 300 loops back to the block 302.

[0027] Referring back to FIG. 2, once the training stage is complete, the computing device 102 performs a detection stage in block 204. One embodiment of a method 400 for performing the training stage of method 200 is illustrated in FIGS. 4a and 4b. The method 400 begins with block 402 in which the computing device 102 determines whether any outgoing traffic has been initiated. As discussed above, the outgoing traffic may be initiated by any one or more background processes being executed on the computing device 102, by a request from a user of the computing device 102, and/or the like. If outgoing traffic has been initiated, the computing device 102 determines whether the destination is listed in a blacklist. The blacklist corresponds to a list of known unsafe destination addresses. For example, the destination address contained in the blacklist may be destinations that have previously been identified as part of a botnet. If the requested destination is listed in the blacklist, an alarm is activated on the computing device 102 and the outgoing traffic is terminated in block 406. The alarm may be an audible and/or a visual alarm. For example, in one embodiment, a pop-up window is displayed to the user to inform that the destination address has been blacklisted and identified as harmful.

[0028] If, however, the requested destination is not listed in the blacklist, the computing device 102 determines whether the requested destination is in the whitelist in block 408. If so, the method 400 loops back to block 402. However, if the requested destination is not in the whitelist, the persistence value for the requested destination is updated in block 410. As discussed above, if multiple observation windows are used, the persistence value associated with each observation window is updated in block 410.

[0029] In block 412, the computing device 102 determines if the persistence value for the requested destination is greater than the threshold value. If a single observation window is being used, the persistence value for the required destination is equal to the persistence value of the single observation window. However, if multiple observation windows are being used, the persistence value may be equal to a weighted combination of the persistence values of the set of observation windows. For example, as discussed above, the persistence value for the destination may be equal to the average persistence value of the set of observation windows (some of which may be weighted differently from others), to the maximum persistence value of the set of observation windows, or to some other value calculated based on the persistence values of the multiple observation windows. Regardless, if the persistence value for the requested destination is less than the threshold value, the method 400 loops back to the block 402.

[0030] However, if the current persistence value of the destination is greater than the threshold value, an alert is generated in block 416. The alert may be an audible and/or a visual alarm. For example, in one embodiment a pop-up window is displayed to the user. The requested destination and the application requesting the destination is displayed in the pop-up window. In block 418, the user is prompted to determine whether the requested destination is a known safe destination. By reviewing the displayed destination and requesting application, the user may determine such information. If the user determines the requested destination is a known safe destination, the destination is added to the whitelist in block 420. However, if the requested destination is not a known safe destination, an alarm is activated in block 422 and the destination is added to the blacklist in block 424. The method 400 subsequently loops back to block 402.

[0031] While the disclosure has been illustrated and described in detail in the drawings and foregoing description, such an illustration and description is to be considered as exemplary and not restrictive in character, it being understood that only illustrative embodiments have been shown and described and that all changes and modifications that come within the spirit of the disclosure are desired to be protected.