%%\documentclass[twocolumn,10pt]{article}
\documentclass[twocolumn,10pt]{article}
%%\documentclass[11pt]{article}
\usepackage{url}
\usepackage{epsfig}

\begin{document}

\title{Anomaly-based Botnet Server Detection\\
}
\author{
James R. Binkley \\
Computer Science Dept.\\
Portland State University\\
Portland, OR, USA \\
{\em jrb@cs.pdx.edu}
}

\newcommand{\thdr}[1]{\multicolumn{1}{c|}{#1}}

%%\hyphenation{attack gigabit}

\maketitle

\begin{abstract}

We present simple statistic techniques for anomaly-based detection
of on-campus botnet servers.  The techniques are based on
two experimental flow tuples that collect statistics based on
counts of Layer 7 IRC messages including PRIVMSG, JOIN, PING,
and PONG messages and to associate IP hosts with IRC channel names.
In the last year we have seen three instances of bot servers.
In each case when compared to normal campus traffic,
every bot server had unusual numbers of IP hosts
per channel, and unusual counts of PING and PONG irc messages.
In addition there seems to be a significant failure mode for bot
servers in that remote clients may be unable to connect to the server
and appear as remote scanners with one host (the server) as the target.
\end{abstract}

\input psfig.tex  

\section{Introduction} \label{introduction}

Botnets \cite{insidelook}\cite{sruti05} are a modern scourge of the Internet
and a cause of spam, denial of service attacks, and infected hosts.
Ourmon \cite{massbink} is a near real-time network monitoring 
and anomaly detection tool.
Originally it was intended as an open-source system akin
to SNMP RMON \cite{rmon2} with the goal of providing web-based graphics
and reports about current network statistics.  Over time we discovered
that it was also an anomaly-based detection system as we discovered
that normal graphics or statistics were sometimes replaced by highly
anomalous activity often associated with scanners, botnets, or DOS attacks.

In this paper we look at two IRC tuples that were created to primarily
track botnet client meshes.  We then look at an example of how
simple statistics associated with thoese IRC tuples proved to also
catch botnet servers and to point out a number of simple statistical
measures that are good botnet server indicators.
 
\section{IRC tuple architecture} \label{tuples}

In our network-based collection system we collect two IRC tuples in
thirty-second scanshots and then correlate the lists every hour
as IRC data emerges in general very slowly.  Here we assume we can 
capture up to 256 bytes worth of every packet
including Layer-7 information such as IRC messages.  IRC messages
are parsed by a hand-coded C parser to form two tuples called the 
{\it node list} and
{\it channel list}.  The first list captures per host IRC information
and the second organizes the hosts by IRC channel names (chatrooms).
We are only interested in four kinds of IRC messages including PING,
and PONG which are used to establish client server connectivity,
and JOIN and PRIVMSG, both of which contain channel names.  We do
not store PRIVMSG IRC data.  

The node list has the following structure and includes an IP address,
as well as a number of statistical counters, and a list of channel
names associated with the host.
\begin{verbatim}
(IPSRC, TOTALMSG, JOINS, PINGS, PONGS,
PRIVMSGS, CHANNELS, SERVERHITS, WW}
\end{verbatim}

The channel list has the following structure and includes the
channel name, various statistics, and a list of IP hosts associated
with the channel during the sample period.

\begin{verbatim}
(CHANNAME, HITS, JOINS, PRIVMSGS,
NOIPS, IP_LIST}
\end{verbatim}

One additional IRC statistic gathered
consists of total counts of the four kinds
of IRC messages seen by the probe during the sample period.  
This tuple is displayed as a graph and we will see an example
of it below.

\section{botserver mesh detection} \label{detection}

Next we turn to botserver mesh detection.  In point of fact, detecting
a botserver in a network domain is fairly trivial once you know the
"signs".   We can distinguish at least four kinds of anomalies and
there are probably more simply due to the large amounts of IRC
traffic.  The main fact to note is that a "successful" botserver
will produce many messages.  Over thanksgiving 2005 (when IT staff
were on vacation), our campus experienced the largest botserver we
have ever seen.  We believe that the botserver in question at its
peak had around 60000 hosts (all off campus) reporting to it.  We
should point out that as is generally the case with anomaly detection,
the analyst should have some notion of normal in terms of local
domain statistics.  In this case one has to have observed local IRC
activity to know what is unusual.  Even so, a bot server is easy
to spot.

Outstanding anomalies included:

\begin{enumerate}
\item
hosts per channel is a very strong indicator of a botserver.  
\item
PING and PONG message counts for our network domain 
as a whole are a strong indicator.
\item
the number of messages for any given IRC server is a strong indicator. 
\item
lastly it can sometimes be the case that the 
overall number of wormy hosts (high work weights) 
counted in our entire network (and within the bot server's IRC channel) 
becomes very high.
\end{enumerate}

We do not currently have a sort for hosts per channel but we note 
anomalies one, two, and four in our list above by looking at 
our "channels sorted by max messages" subsection as seen in table
\ref{serverbotnet}.

\begin{table*}
\centering
\caption{Malign IRC Botnet Server - Max Messages in Channels Report}\label{serverbotnet}
\begin{tabular}{|l|r|r|r|r|r|r|} \hline
{channel} &
\thdr{msgs} & 
\thdr{joins} & 
\thdr{privmsgs} & 
\thdr{ipcount} & 
\thdr{wormyhosts} & 
\thdr{evil} \\ \hline
f & 157403 & 156956 & 447 & 36727 & 1704 & E  \\ \hline
x & 81161 & 40196 & 40965 & 13821 & 712 & E \\ \hline
f-exp & 20845  & 0 & 20845 & 5074 & 562 & E \\ \hline
studentchannel & 11560 & 5509 & 6051 & 12 & 0  & \\ \hline
\end{tabular}
\end{table*}

From experience we know that "studentchannel" is benign (although
automated in terms of both JOINS and PRIVMSGS), and in any case has
a historically normal count of messages and hosts.  On the other
hand, channels f, x, and f-exp are new.   
The message count for f alone is
historically very high and an order of magnitude higher when compared
to "studentchannel".  The above statistics are for the entire day,
and busy chat channels on our campus driven by human text messages
usually have no more than 2000 messages in one day.  Therefore
channel x and its 40965 PRIVMSGS are an anomaly.  
A more significant anomaly appears
with the ipcount (number of hosts in the channel) for the three
channels in question.  On our campus we have never seen a normal chat IRC
channel with more than 100 hosts in it.  Of course, further analysis
shows that these numbers are even more significant because the three
channels in question are shown elsewhere to share the same botnet server.  
The number of hosts with high work weights in the channels is 
also an interesting anomaly.  

In table \ref{evilchans} these three channels along with a 
fourth related channel called "exp" all appeared at the top of our 
evil channel subsection on the first day of the botnet server.

\begin{table*}
\centering
\caption{Malign IRC Botnet Server - Evil Channel Report}\label{evilchans}
\begin{tabular}{|l|r|r|r|r|r|r|} \hline
{channel} &
\thdr{msgs} & 
\thdr{joins} & 
\thdr{privmsgs} & 
\thdr{ipcount} & 
\thdr{wormyhosts} & 
\thdr{evil} \\ \hline
f & 157403 & 156956 & 447 & 36727 & 1704 & E \\ \hline
x & 81161 &  40196 &  40965 & 13821 & 712 & E \\ \hline
f-exp &  20845 &  0 & 20845 & 5074 & 562 & E \\ \hline
exp & 6825 & 0 & 6825 & 423 & 101 & E \\ \hline
\end{tabular}
\end{table*}

Let us turn to anomaly number three.  In a previous section we
mentioned that we keep global count statistics for all IRC messages
on our network and graph them using the RRDTOOL graph mechanism.
Please refer to Figure \ref{bot_msg}.  This graph shows a weekly
view of the four basic IRC message types.  Normal daily counts for
all message types are typically in the hundreds.  Here we can see that on
Friday and Saturday PING and PONG messages suddenly are
in the thousands.  In all three bot servers we have seen on campus,
PING and PONG messages were always elevated.  In one case, PRIVMSG
was elevated as well.  All bot servers so far have been enough
to significantly perturb this graph.  This is easy to understand
because the PSU campus as a whole at peak periods sans a botserver
has only a couple of hundred IRC hosts total.

\section {Conclusion} \label {conclusion}

Known techniques for botnet detection include honeynets and IDS
systems such as snort\cite{snort} with signature detection.  
Honeynets \cite{honeybot} or
darknets can
certainly prove beneficial in terms of providing information about
botnet technology.  

We have recently published related work elsewhere on botnet-client
detection using anomalies and present our botnet-server anomaly detection
work here.  We believe our anomaly-based work is an advance in
the art, but ideally in the future we would like to be able to
detect botnets via only layer 3 or layer 4 statistics as it is possible
that layer 7 data may be obfuscated in the future.

\begin{thebibliography}{99}
\raggedright

\bibitem{insidelook}
P. Barford, V. Yegneswaran, 
An Inside Look at Botnets, 
{\it Special Workshop on Malware Detection, Advances in Information Security}, 
Springer Verlag, 2006 

\bibitem{massbink}
J. Binkley, B. Massey, 
Ourmon and Network Monitoring Performance.
{\it Proceedings of the Spring 2005 USENIX Conference, Freenix track},  
Anaheim, April 2005.

\bibitem{sruti05}
E. Cooke, F. Jahanian, and D. McPherson, 
The zombie roundup: Understanding, detecting and disrupting botnets. 
{\it In Proceedings of Usenix Workshop on Steps to Reducing
Unwanted Traffic on the Internet (SRUTI '05)}, 
Cambridge, MA, July 2005.

\bibitem{sruti06}
James R. Binkley, and Suresh Singh,
An Algorithm for Anomaly-based Botnet Detection,
{\it In Proceedings of Usenix Workshop on Steps to Reducing
Unwanted Traffic on the Internet (SRUTI '06)}, 
San Jose, CA, July 2006.

\bibitem{honeybot}
The Honeynet Project and Research Alliance.
Know Your Enemy, Tracking Botnets. 
\url{http://honeynet.org/papers/bots}, March 2005.

\bibitem{snort}
Snort IDS web page. 
\url{http://www.snort.org}, March 2006.

\end{thebibliography}

\clearpage

\begin{figure*}[th]
\centerline
\mbox{\psfig{figure=ircweekly.eps,height=3.2in,width=7in}}
\caption{Thanksgiving Botserver IRC Message Counts}
\label{bot_msg}
\end{figure*}

\begin{figure*}[bh]
\centerline
\mbox{\psfig{figure=wormcount.eps,height=3.2in,width=7in}}
\caption{TCP Scanners During Bot Attack}
\label{botworm}
\end{figure*}

\clearpage

\end{document}
