# The Case for a Collaborative Universal Peer-to-Peer Botnet Investigation Framework

## Full Text

This Markdown is an automated text extraction for search and reading tools. The [hosted PDF](TheCaseForACollaborativeUniversalP2PBotnetInvestigationFramework.pdf) is the authoritative publication source.

Source PDF: [TheCaseForACollaborativeUniversalP2PBotnetInvestigationFramework.pdf](TheCaseForACollaborativeUniversalP2PBotnetInvestigationFramework.pdf)
Source SHA-256: `b014e2c634287263be26a6119f4155b337f57db1c431b68a631b08fe77fc9147`
Generated with `pdftotext -nopgbrk`; formatting and reading order may differ from the PDF.

---

TheCaseforaCollaborativeUniversalPeerͲtoͲPeerBotnet
InvestigationFramework
MarkScanlonandTaharKechadi
UCDSchoolofComputerScienceandInformatics,UniversityCollegeDublin,Belfield,
Dublin4,Ireland
mark.scanlon@ucd.ie
tahar.kechadi@ucd.ie
Abstract:PeerͲtoͲPeer(P2P)botnetsarebecomingwidelyusedasalowͲoverhead,efficient,selfͲmaintaining,distributed
alternative to the traditional client/server model across a broad range of cyberattacks. These cyberattacks can take the
form of distributed denial of service attacks, authentication cracking, spamming, cyberwarfare or malware distribution
targeting on financial systems. These attacks can also cross over into the physical world attacking critical infrastructure
causing its disruption or destruction (power, communications, water, etc.). P2P technology lends itself well to being
exploitedforsuchmaliciouspurposesduetotheminimalsetup,runningandmaintenancecostsinvolvedinexecuting a
globallyorchestratedattack,alongsidetheperceivedadditionallayerofanonymity.IntheeverͲevolvingspaceofbotnet
technology,reducingthetimelagbetweendiscoveringanewlydevelopedorupdatedbotnetsystemandgainingtheability
tomitigateagainstitisparamount.Often,numerousinvestigativebodiesduplicatetheireffortsincreatingbespoketools
to combat particular threats. This paper outlines a framework capable of fast tracking the investigative process through
collaborationbetweenkeystakeholders.
Keywords:peerͲtoͲpeer,botnet,mitigation,computerforensics,investigation,framework

1. Introduction
Discussions and reporting of technology savvy criminals attacking financial institutions, governments and
corporate assets have become regular news stories in recent years. Many of these attacks target specific
institutionsmotivatedbypoliticalorfinancialgoals.Thesecyberattackscanbeaidedbyanumberofdifferent
advancesintechnologyinrecentyearsbutoneofthemostthreateningtechnologiestobeexploitedforthese
malicious purposes is the capability to execute crimes remotely using botnets. Botnets take the form of
massivegloballydistributednetworksofzombieslavemachinescapableofexecutingthecommandsoftheir
creator,thebotmaster.Infinancialterms,thesedistributednetworksarelargelyresponsiblefortheexecuting
of numerous financially motivated crimes, such as online payment account and bank account cracking,
spamming,distributeddenialofserviceattacks,etc.Riccardietal.(2012)foundthattheZeusbotnetaloneis
estimatedtohavecauseddamagesofover$100millionUSDsinceitsdiscoveryin2007throughthetargeting
offinancialwebsites.
Of course the dangers of distributed cyberattacks are not solely limited to financial crimes. Increasingly
botnets are becoming the weapon of choice in new online battlefields. Parks and Duggan (2011) defined
cyberwarfareascyberattackswithkineticornonͲcyberworldaffects.Cyberwarfareisaveryrealcomponentof
modernconflict. Cyberwarfare attacks arecommonlyoccurringbetween countries that are not physically at
ware.Forexample,cyberwarfareattacksfromNorthKoreaontheU.S.werefoundtobeup800%intheperiod
from2005Ͳ2007bytheU.S.DepartmentofHomelandSecurity(Lee,2011).
The Anonymous “hacktivist” group attacks in recent years have displayed the power of distributed
computationalcontributiontobotnetpoweredattacks.Thecontributiontotheseattacksisnotsolelyinnocent
victims'machineshavenbeentakencontrolofbyabotmasterͲregularInternetuserswithsharedpoliticalor
activist views voluntarily decided tocontribute their processing power to a collaborative cause. Partaking in
the Anonymous attacks involved users downloading and configuring an open source network stressͲtesting
toolcalled“LowOrbitIonCannon”(LOIC).Alternatively,usershadtheoptiontodonatetheircomputational
power via a JavaScriptͲbased version facilitating anyone who visits the site to participate in the attack
(MansfieldͲDevine, 2011). Regular P2P fileͲsharingnetworks, such asBitTorrent, can alsobe manipulated by
malicious users to aid in the execution of a DDoS attack through the exploitation of vulnerabilities in the
protocolandoperationofthenetwork(ElDefrawyetal.,2007).Inacyberwarfarescenario,itisconceivable
that citizens of countries with limited computational infrastructure or supporters of terrorist organizations
could similarly be called upon to donate their systems to aid in a collaborated attack on an enemy's
infrastructure.Throughouttheworld,asignificantamountofeffortistakeninanattempttocombatmalicious

287


MarkScanlonandTaharKechadi
botnetactivity.Muchofthiseffortisduplicatedwithdifferentinvestigativeandresearchentitieseachcreating
bespoketoolsfocusedonaparticularbotnetsystem,oronaparticularbotnetvariant.Thispaperproposesa
botnetinvestigationframeworkcapableofeliminatingmuchofthisduplicatedeffortandimprovingtheoverall
reactiontimeofthebotnetforensiccommunity.

1.1 Motivationsbehindcyberattacks
Thepotentialforattacksoriginatingfromagrowingnumberofsourcesisaconcernforthesecurityofmany
nationsacrosstheglobe.Amoroso(2012)definedfivepossiblemotivationsbehindcyberattacks:
ƒ

CountryͲsponsored warfare Ͳ This is whereby enemy cyber forces attack national infrastructure in an
attempt to disable critical resources of the opposing country in a similar manner to traditional physical
warfare.Onlytheresourcesanddevotionoftheattackingnationlimittheintensityofthisattack.InaP2P
botnet facilitated attack, citizens could voluntarily donate their computing power towards the national
goalsinasimilarmannertotheAnonymousattacksoutlinedabove.

ƒ

TerroristAttackͲGroupsdrivenbyterroristmotivationscouldquicklygainsufficientfundingandexpertise
toconducttheirattacks.Alsointhisscenario,regularInternetuserscouldpartakeinaterroristoperation
withoutrequiringanyskillorexpertisebydonatingtheirregularcomputerequipmenttotheattack.

ƒ

Commercially motivated attack Ͳ Competing companies might target their competitors' eͲcommerce
infrastructure in order to prevent regular users from purchasing anything from their online stores. A
popular eͲcommerce site being taken offline has the added effect of harming the victim company's
reputationintheircustomers'eyes.

ƒ

Financially driven criminal attack Ͳ These types of attacks could target individual computer users by
recordingtheirInternetbankingdetails,onlinepaymentservicesandotherfinancialservices.Companies
canalsobetargetedwithextortionthreatsagainsttheironlineinfrastructure.

ƒ

HackingͲThisscenariogenerallyinvolvesanindividualorgroupofhackersattackingtargetsmotivatedby
littlemorethanmischieforattainingonlinerecognitionoftheirachievements.

1.2 P2Pnetworks
Since P2P networking has become mainstream, the technology has been deployed across a broad range of
systems and services. While the level of variation in topologies is significant, all P2P networks must share a
numberofcommonattributes:
ƒ

Capabilitytoconnecttothenetwork(bootstrapping)ͲWhenanewnodewishestojointhenetwork,it
must have the ability to contact at least one other active participant in the network. Depending on the
network design, this may take the form of a hardcoded list of active nodes (typical in a decentralized
topology)oralistofbootstrappingservers(typicalinacentralizedtopology)(Conrad&Hof,2007).

ƒ

Record Maintenance of Active Nodes Ͳ In a decentralized network the peers themselves must all
contributetotherecordingofactivenodesonthenetwork.Nosinglepeerhastheentirelist,witheach
peer contributing to a collective distributed database, typically a distributed hash table (DHT). In a
centralized design, this duty falls on the controlling server(s). As each new node comes online, it
announces its presence to the database maintainer and requests a list of other active peers to begin
working.

ƒ

Query/Order/FilePropagationͲInorderforaP2Pnetworktofulfillwhateverthepurposeitwasdesigned
for,intraͲpeercommunicationisrequisite.Asaresultofthisnecessity,eachpeermustbeabletoreceive
requestsorcommandsandpassthesecommunicationsontootherknownpeers.

ƒ

SoftwareMaintenanceͲTheP2Penabledbinarycanquicklybecomeoutdated.Theupgradeprocessmust
besimpletoperformwhilemaintainingnodeuptime.Whilenewerversionsoftheapplicationmighthave
additionalfunctionality,itmusttoensurebackwardscompatibilityotherwisethenetworkasawholemay
suffer.

Inthispaper,weintroduceaframeworkthatenablesforensicinvestigatorsandresearcherstofasttrackthe
investigationofanyP2Pnetwork.Theframeworkexploitsmanyofthecommonattributesofthesenetworks
outlined above. Each node on a P2P network has two main functions. The first involves participating in the
maintenanceofthenetworkitselfͲͲitisawareofanumberofothernodes,andisincommunicationwitha

288

MarkScanlonandTaharKechadi
subset of the overall population. From the analysis of the P2P communication of an active node in the
network,commoncommunicationscanbeidentified,e.g.,peerdiscovery,query/command/filepropagation,
etc.Onceeachofthesecommunicationpatternsisidentified,thebehaviorofanactivenodecanberecorded
in a centralized shared database. The sharing of identified patterns will aid in the elimination of duplicated
work by forensic investigators. As the contribution to the framework increases, both the database of
identifiabletrafficpatternsandthevalueofusingtheframeworkwillbecomesignificantlygreater.

2. Premiseforuniversalinvestigationframework
The collaborative investigative frameworkproposed cantake advantage of the fundamental commonality in
designofmostP2Pbotnetsystems:
ƒ

The fundamental requirement for intraͲpeer communication resulting in any compromised machine
gainingtheabilitytocommunicatewithotherpeersonthenetwork.

ƒ

TheabilitytoselfͲpropagatetofurthervulnerablemachines.

ƒ

Therequirementforeachnewlyinfectedmachinetoconnectwiththebotmasterortothebotnetitselfto
receiveitslatestorder.

ƒ

Therequirementforeachactivenodeinthenetworktomaintainalocallistofotheractivenodes.

ƒ

Thecompulsorycommandforwardingresponsibilityofeachnode.

Wangetal.(2009)definedthecharacteristicsofcommonbotnetdesignsintothreemaintypesofP2Pbotnets:
parasitic, leeching and botͲonly. Parasitic botnets take advantage of vulnerable hosts within an existing P2P
networkwiththeupperlimitofthebotnet'sgrowthbeingthenumberofvulnerablemachinesonthenetwork.
LeechingbotnetsreferstodesignsthatdependonanexistingP2Pnetworkfortheircommunication.Afulllist
ofthecharacteristicsof3botnetvariationscanbeseeninTable1below.
Table1:ComparisonofthreetypesofP2PBotnets
Features
InfectionVectors
BotCandidates
BootstrapProcedure
Membersinthe
Network
Communication
Protocols
Command&Control
Styles

Parasite
P2Pmalware
VulnerablehostsinP2P
networks
None
Legitimatepeersandbots

Leeching
Anykindofmalware
Vulnerablehostsinthe
Internet
Required
Legitimatepeersandbots

BotͲonly
Anykindofmalware
VulnerablehostsintheInternet

ExistingP2Pprotocols

ExistingP2Pprotocols

PullorPush

PullorPush

SelfͲdesigned/existingP2P
protocols
PullorPush

Required
Onlybots

The framework should be designed in such a modular manner to facilitate the convenient plug in of the
characteristicsandcommunicationsignaturesofanyparticularP2Pbotnet.Standardinvestigationtypes,such
asbotnetenumeration,nodeclassification,botmastereavesdroppingandpotentialbotmasteridentification,
can all be included as part of the framework. The conduction of any of the aforementioned investigations
wouldrequiretheappropriateprotocolandcommunicationsignaturebeingrecordedforeachofthediffering
networks.Theframeworkitselfcouldtakecontroloftheinvestigationfromthatpoint.Thekeytothesuccess
ofsuchaframeworkliesinasufficientlycomprehensivecentralizeddatabaseofbotnetsbeingcontributedto
byinterestedstakeholders.
Traditionally, the time required from the identification of a botnet to gaining the ability to partake in the
network might require hundreds, if not thousands, of manͲhours. It is envisioned that using a standardized
frameworkcangreatlyexpeditetheprocess.Withsufficientcontributionfromnetworksecurityandforensic
expertsintheidentificationandcharacterizingofbotnetsignatures,theframeworkoutlinedinthispaperwill
havetheabilitytoquicklyfacilitatetheinvestigationofanyknownbotnetandtoquicklyadapttothediscovery
ofnewnetworks.
Another significant advantage to such a framework is to aid in the elimination of the duplication of efforts.
Botnet researchers around the world from law enforcement, public institutions and private corporations
wouldeachbenefitfromthecollaborativesystem.P2Pbotnetsaidcriminalsinthedistributedperpetrationof

289


MarkScanlonandTaharKechadi
their crimes Ͳ it seems fair that the targets and protectors against these crimes should also have a unified
globalnetworktocombatthesecrimes.


Figure1:StepsInvolvedinatypicalP2PBotnetinvestigation

3. Universalframeworksystemcomponents
Theframeworkisdesignedtobeasmodularaspossible.Thisfacilitatesitsexpandabilityinthefutureasmore
networksandcomponentsareadded.Thecorecomponentsofthesystemareoutlinedbelow:
ƒ

NetworkSignaturesͲThesignaturesforagivenP2Pbotnetwillhavetwocomponents;aspecificationof
the communication commands available to any node on the network and a parameter file. The
specification will store the formats required for each command required for intraͲpeer chatter. The
parameter file will define the network and its features, e.g., DHT, peer exchange, communication
frequencies,etc.

ƒ

ClientEmulatorͲThismoduletakestheabovenetworksignaturesandconnectstothebotnetinquestion.
Themethodsandfrequencyofcommunicationwitheachpeerwillbeprovidedfromthesignature.The
purposeofthiscomponentistoensuretheappearanceoftheframeworkonthenetwork.Toeachother
node, it is imperative that any investigative tool appears as though it is any other regular node on the
network.

ƒ

InvestigationControllersͲManipulationoftheparametersoftheemulatorcanresultintheexecutionof
the differing investigation types outlined above. Each investigation type will have its own controller
modulethatisresponsiblefortheinvestigation.

ƒ

Evidence Storage Ͳ The evidence collected will be stored in an evidence bag. Both the network stream
captured during the investigation alongside the interpreted evidence gathered by partaking on the
network.TheintegrityofthisevidenceisparamountandisdescribedingreaterdetailintheSection4.5.

4. P2Pnetworkinvestigationtypes
Once the communication method of the undocumented network is reverse engineered through traditional
meansandtherequiredsignaturesstoredinthedatabase,crawlingthenetworkwillthenbepossiblebyany
contributingagencyorinstitution.Theframeworkisdesignedtoaidinthefollowinginvestigationtypes:

4.1 Evidencecollection
Inordertocombattheunauthorizeddownloadingofcopyrightedmaterial,manycountrieshaveimplemented
athreetosixstrikes``graduatedresponse''systemwherebyrepeatoffenderswillhavetheirInternetservice
discontinuedforadefinedpenaltyperiod(Serbin,2012).Inorderforsuchsystemstooperate,evidencemust
begatheredtoprovethatinfringementhastakenplace.Inabotnetinvestigation,theevidencecollectedmight
take the form of the commands issued, the origin of these commands, the targets of an attack, etc. The
conceptofevidencecollectioniseasilyunderstoodwithrespecttoillegalfilesharingandbotnetinvestigations,
butitcanequallyapplytomorelegitimateP2PapplicationssuchasVoiceoverIP(VoIP)services,e.g.,Skype
(Baset&Schulzrinne,2004),orinstantmessagingservices,e.g.,AIMorMSNMessenger(Jenningsetal.,2006).

4.2 Anatomy
Investigating the anatomy of a particular network involved the analysis of the client binary's behaviour and
analysisofthenetworkcommunicationpatterns.Thistypeofinvestigationattemptstoclassifythesystemas
centralized/decentralized, ClientͲServer/P2P hybrid or solely P2P based command and control. An anatomy
documentationinvestigationcancontinuepastthenetworkarchitectureofthesystemtocoversomeofthe
counterͲdetection and antiͲforensic techniques employed. For example, Goel et al. (2006) discovered that
``Agobot''hadabuiltindefencemechanismtoterminatetheexecutionofaremotelyupgradablelistofover
610antiͲvirusprograms.TheStormwormwasalsoengineeredtoaggressivelyusethedistributedbotnetto
collectivelyattackanyonewhoattemptedtoreverseengineerit(Mukamurenzi,2008).

290


MarkScanlonandTaharKechadi


4.3 WideͲareameasurement
This concentrates on attempting to enumerate the population of the network, its bandwidth, its
computational power or its oftenͲmultifaceted goals. Gathering the population of a P2P network is
traditionallyanonͲtrivialtaskasthenumberofnodeseverconnectingtoanysinglenodeortoaCommand
andControl(C&C)servermayonlycountforasmallproportionoftheparticipatingnodes.Rajabetal.(2007)
specifiedthattherearetwodefinitionsofaP2Pnetwork'ssize:
ƒ

Footprint Ͳ This indicates the aggregated total number of machines that have been compromised over
time.

ƒ

Live Population Ͳ This measure denotes the number of compromised machines that are concurrently in
communicationwitheachother.

Inthecaseofmeasuringadocumentednetwork,e.g.,BitTorrent,acustomcrawlermustbebuiltwhichcan
efficientlycollectpeerinformation.Inthecaseofanundocumentednetwork(e.g.aP2Pbotnet),arelatively
straightforwardmethodformeasuringthepopulationofthenetworkistorunabotonadeliberatelyinfected
machine and monitor the resultant network traffic. The number of IP addresses the infected node is in
communication with can be easily counted having eliminated all nonͲbotnet related network traffic. It is
unsafetoassumethatasinglenodewillultimatelycommunicatewitheveryothernodeinthenetworkover
anyreasonabletimeframe.Traditionalenumerationinvestigationincreasethenumberofinfectedmachines
(physicallyorvirtually)andamalgamatetheresultsshouldleadtoamoreaccuraterepresentation.Usingthe
framework, regular client usage can be amplified to achieve the required results in a significantly timelier
manner.

4.4 Takeover
Botnettakeoverinvolvesathirdpartygainingcontrolofabotnetfromitsowner.Thisthirdpartycouldbelaw
enforcement, researchers or another cybercriminal. Once control has been gotten of the botnet, the new
botmasterisabletoissuecommands,updateconfigurationsandoperatethebotnetasdesired.StoneͲGrosset
al. (2009) successfully took over the Torpig botnet for 10 days. During this time, the researchers identified
more than 180,000 compromised machines and were sent over 70GB of automatically harvested personal
information.ThenumberofdiscovereduniqueTorpigbotIDsandcorrespondingnumberofIPaddresseswas
observed to be 182,914and 1,247,642 respectively(StoneͲGross et al.,2011). The discrepancy between the
numberofbotsandIPaddressesfoundisaccountablebynetworkeffectssuchasDynamicHostConfiguration
Protocol (DHCP) churn and Network Address Translation (NAT), as described in greater details in Section 5
below.

4.5 Forensicintegrity
Due to the sensitive nature of digital evidence collection, it is imperative that the data collected by any
forensic tool is absolutely verifiable and identical to the original source. This integrity is ensured in the
framework through the implementation of a new live digital evidence bag designed to operate with P2P
network evidence collection. This evidence bag will record all pertinent information, e.g., IP addresses,
packets,runningprocesses,etc.,alongsidetherawnetworktrafficcapture.BypartakingintheP2Pnetwork
itself,theevidencegathereddoesnotneedtobereverseengineered,i.e.,alloftheinformationavailabletoa
regularclientofthatnetworkwillbeamplifiedandrecordedinthisevidencebag.Onceanynetworktrafficis
collected, each packet is timeͲstamped and logged. The time stamping facilitates realͲtime event
reconstructionpacketbypacket,emulatingtheoriginaltraffic.

The integrity of any evidence collected by the framework will be insured through the implementation of
regularhashcheckingonthedatabeingcollectedusingSHAͲ512(SecureHashingAlgorithmproducinga512Ͳ
bitlonghash).Thesystemcollectsastreamofinformation,thestreamitselfishashedandbotharestoredon
theexternaldriveorcanbeuploadedtosecurecloudstorage.Duringthetransmissionprocess,theintegrityof
each of the chunks being transferred is maintained due to a SHAͲ512 hash being computed as the chunk is
beingtransmitted.ServerͲside,oncethetransmissioniscompleted,aSHAͲ512hashistakenonthechunkand
verified against the original. If these hashes do not match, i.e., the integrity of that chunk has been
compromisedintransmission,afailurenotificationissenttotheclient,whichqueuesthatchunkupagainfor
transmission.


291


MarkScanlonandTaharKechadi

5. Advantages
Implementingauniversalcollaborativeframeworkquicklyandeasilyfacilitatesdifferentinvestigativebodies
conductingsimilarinvestigationsworldwide.Someofthespecificadvantagesareoutlinedbelow:
ƒ

Compatibility Ͳ Having a centralized framework facilitates the integration with numerous other network
forensic tools as required. Expandability is also ensured through the modularization of the components
andspecificationoftheindividualnetworks.

ƒ

CostͲThecostsavingsforparticipatinginsuchacollaborativeframeworkaresignificant.Eliminatingthe
duplicateddevelopmentofbespoketoolswillgreatlyreducetheresourcesrequired.

ƒ

AutomatedIdentificationͲWithasufficientlylargedatabaseofknownnetworksestablishedautomated
identification.

ƒ

CrossͲborder cooperation Ͳ Differing interests across national borders should be advantageous tot he
system as a whole. Differing bodies developing the signatures required for their own operational
requirementswillresultinamorecompleterobustdatabaseofsignatures.

ƒ

Speed Ͳ The regular P2P botnet investigation process can be seen in Figure 1. Using the framework
described, the entire investigation process is fastͲtracked as far as Step 4 for each contributing body
(assuming the network is already documented). The final analysis phase can also be expedited through
commonevidenceprocessingprocedures.

6. Potentialissues
As with any system designed with a requirement for collaboration between differing global bodies and
organizations,thereareanumberofpotentialissues:
ƒ

Key Stakeholder BuyͲin Ͳ Without a sufficient contribution towards the framework (both the core
functionalityandthebotnetsignatures),thesystemcanrapidlybecomeoutͲdatedincomparisonwiththe
quickprogressioninbotnettechnologies.

ƒ

Access Maintenance and Control Ͳ A framework that potentially has the ability to infiltrate and take
controloveranyreverseengineeredbotnetissomethingthatwouldbehighlyvaluableifitgotintothe
wronghands.Controllingaccesstosuchaframeworkisparamounttoitsreliabilityandusefulnesstolaw
enforcementandforensicinvestigators.Onesolutiontothisissuewouldbefortheframeworktorequire
serverͲsideauthentication/updatebeforeanyinvestigationcancommence.

ƒ

CorporateParticipationͲWhilehavingcollaborationfromprivatecorporationswouldbeadvantageousto
thesystemasawhole,fromacorporateperspectivehavingexclusivityonthesolutiontoanyproblemis
fundamental to many business models. As a result, it is envisioned that the system will primarily be
contributedtoandusedbylawenforcementandresearchinstitutions.

7. Conclusionsandfuturework
A proofͲofͲconcept framework has been created capable of integrating with a number of common P2P
networks, such as BitTorrent, with modules implemented for each of their constituent components. This
proofͲofͲconcept needs to be expanded to cover a broader range of technologies, such as modules for the
populardistributedhashtables.TheeverͲgrowingrangeofcrimesperpetratedbyglobaldistributednetworks
of zombie machines is staggering. Having key stakeholders such as researchers, digital investigators, law
enforcement and security experts pool and share their expertise and efforts can significantly aid in the onͲ
goingbattleagainstcyberattacks.

Acknowledgements
This work has been coͲfunded by the Irish Research Council and Intel Ireland Ltd. through the Enterprise
Partnership Scheme. The authors also wish to acknowledge the contribution of Amazon for supporting this
researchthroughanAmazonWebServicesresearchgrant.

References
Amoroso,E.G.2012,Cyberattacks:protectingnationalinfrastructure,Elsevier.
Baset,S.A.&Schulzrinne,H.2004,'AnanalysisoftheskypepeerͲtoͲpeerinternettelephonyprotocol'.

292

MarkScanlonandTaharKechadi
Conrad,M.&Hof,H.ͲJ.2007,'Ageneric,selfͲorganizing,anddistributedbootstrapserviceforpeerͲtoͲpeernetworks',,59Ͳ
72.
ElDefrawy,K.,Gjoka,M.,&Markopoulou,A.2007,BotTorrent:misusingBitTorrenttolaunchDDoSattacks,USENIX
Association.
Goel,S.,Baykal,A.,&Pon,D.2006,'Botnets:theanatomyofacase',JournalofInformationSystemsSecurity.
Jennings,R.B.,Nahum,E.M.,Olshefski,D.P.,Saha,D.,Shae,Z.ͲY.,&Waters,C.2006,'Astudyofinternetinstant
messagingandchatprotocols',Network,IEEE,20,4,16Ͳ21.
Lee,S.2011,'USSecurityStrategytowardNorthKorea'sCyberTerrorism',CarnegieInstitutionforScience.
MansfieldͲDevine,S.2011,'Anonymous:seriousthreatormereannoyance?',NetworkSecurity,2011,1,4Ͳ10.
Mukamurenzi,N.M.2008,'StormWorm:AP2PBotnet'.
Parks,R.C.&Duggan,D.P.2011,'PrinciplesofCyberwarfare',Security&Privacy,IEEE,9,5,30Ͳ35.
Rajab,M.A.,Zarfoss,J.,Monrose,F.,&Terzis,A.2007,Mybotnetisbiggerthanyours(maybe,betterthanyours):whysize
estimatesremainchallenging,USENIXAssociation.
Riccardi,M.,Pietro,R.D.,Palanques,M.,&Vila,J.A.2012,'Titans'revenge:detectingZeusviaitsownflaws',Computer
Networks.
Serbin,D.2012,'TheGraduatedResponse:DigitalGuillotineoraReasonablePlanforCombatingOnlinePiracy?',
IntellectualPropertyBrief,3,3,4.
StoneͲGross,B.,Cova,M.,Cavallaro,L.,Gilbert,B.,Szydlowski,M.,Kemmerer,R.,Kruegel,C.,&Vigna,G.2009,Yourbotnet
ismybotnet:analysisofabotnettakeover,ACM.
StoneͲGross,B.,Cova,M.,Gilbert,B.,Kemmerer,R.,Kruegel,C.,&Vigna,G.2011,'Analysisofabotnettakeover',Security
&Privacy,IEEE,9,1,64Ͳ72.
Wang,P.,Wu,L.,Aslam,B.,&Zou,C.C.2009,AsystematicstudyonpeerͲtoͲpeerbotnets,IEEE.

293