Botnets

Botnets continue to be an active threat against firms or companies and individuals worldwide. Previous research regarding botnets has unveiled information on how the system and their stakeholders operate, but an insight on the economic structure that supports these stakeholders is lacking. The objective of this research is to analyse the business model and determine the revenue stream of a botnet owner. We also study the botnet life-cycle and determine the costs associated with it on the basis of four case studies. We conclude that building a full scale cyber army from scratch is very expensive where as acquiring a previously developed botnet requires a little cost. We find that initial setup and monthly costs were minimal compared to total revenue.

In recent times, organisations in a variety of businesses, such as healthcare, education, and others, have been using the Internet of Things (IoT) to produce more competent and improved services. The widespread use of IoT devices makes our lives easier. On the other hand, the IoT devices that we use suffer vulnerabilities that may impact our lives. These unsafe devices accelerate and ease cybersecurity attacks, specifically when using a botnet. Moreover, restrictions on IoT device resources, such as limitations in power consumption and the central processing unit and memory, intensify this issue because they limit the security techniques that can be used to protect IoT devices. Fortunately, botnets go through different stages before they can start attacks, and they can be detected in the early stage. This research paper proposes a framework focusing on detecting an IoT botnet in the early stage. An empirical experiment was conducted to investigate the behaviour of the early stage of the botnet, and then a baseline machine learning model was implemented for early detection. Furthermore, the authors developed an effective detection method, namely, Cross CNN_LSTM, to detect the IoT botnet based on using fusion deep learning models of a convolutional neural network (CNN) and long short-term memory (LSTM). According to the conducted experiments, the results show that the suggested model is accurate and outperforms some of the state-of-the-art methods, and it achieves 99.7 accuracy. Finally, the authors developed a kill chain model to prevent IoT botnet attacks in the early stage.

Android is increasingly being targeted by malware since it has become the most popular mobile operating system worldwide. Evasive malware families, such as Chamois, designed to turn Android devices into bots that form part of a larger botnet are becoming prevalent. This calls for more effective methods for detection of Android botnets. Recently, deep learning has gained attention as a machine learning based approach to enhance Android botnet detection. However, studies that extensively investigate the efficacy of various deep learning models for Android botnet detection are currently lacking. Hence, in this paper we present a comparative study of deep learning techniques for Android botnet detection using 6802 Android applications consisting of 1929 botnet applications from the ISCX botnet dataset. We evaluate the performance of several deep learning techniques including: CNN, DNN, LSTM, GRU, CNN-LSTM, and CNN-GRU models using 342 static features derived from the applications. In our experiments, the deep learning models achieved state-of-the-art results based on the ISCX botnet dataset and also outperformed the classical machine learning classifiers.
Citation: Yerima, S.Y.; Alzaylaee, M.K.; Shajan, A.; P, V. Deep Learning

The popularity of IoT smart things is rising, due to the automation they provide and its effects on productivity. However, it has been proven that IoT devices are vulnerable to both well established and new IoT-specific attack vectors. In this paper, we propose the Particle Deep Framework, a new network forensic framework for IoT networks that utilised Particle Swarm Optimisation to tune the hyperpa-rameters of a deep MLP model and improve its performance. The PDF is trained and validated using Bot-IoT dataset, a contemporary network-traffic dataset that combines normal IoT and non-IoT traffic, with well known botnet-related attacks. Through experimentation, we show that the performance of a deep MLP model is vastly improved, achieving an accuracy of 99.9% and false alarm rate of close to 0%.

JAKU TARGETS SPECIFIC VICTIMS

What makes JAKU unique is that within the noise of thousands of botnet victims, it targets and tracks a small number of specific individuals. These individuals include members of International Non-Governmental Organisations (NGOs), Engineering Companies, Academics, Scientists and Government Employees. North Korea (DPRK) and Pyongyang are the common theme shared between these individuals.

JAKU targets its victims - 19,000 is a conservative estimate of the number of victims at any one time - primarily via 'poisoned' BitTorrent file shares. The victims are spread all over the globe, but a significant number of victims are in South Korea and Japan. Forcepoint Security Labs has determined that the botnet Command and Control (C2) servers identified are also located in the APAC region, including Singapore, Malaysia and Thailand.

JAKU IS SOPHISTICATED AND RESILIENT

JAKU uses three different C2 mechanisms, making it highly resilient. Compressed and encrypted code embedded in image files are used to deliver the second stage malware, while the botnet controllers monitor the botnet members via obfuscated SQLite databases. The controllers also cleverly re-use widely available open source software, including the UDT network transport protocol, software copied from Korean blogger sites and re-writes of previously published code.

HOW AND WHEN DID WE DO THE RESEARCH?

The JAKU investigation began in late October 2015.  We have collected, collated and processed an estimated 1.7TB of telemetry data during the 6 month investigation.

WHO IS BEHIND THE JAKU BOTNET CAMPAIGN?

Forcepoint Security Labs focus on awareness and understanding of intent. This is useful to identify likely future behaviour. We do not focus on specific attribution. However, there are indicators that suggest that the author(s) of the malware identified are native Korean speakers.

There is a lack of clarity within the social media domain about the number of discrete participants. Influence
and measurement within new media is skewed towards the biggest numbers, resulting in fake tweets, sock
puppets and a range of force multipliers such as botnets, application programming interfaces (APIs), and
cyborgs. Social media metrics are sufficiently manipulated away from authentic discrete usage so that the
trustworthiness of identity, narrative and authority are in a constant state of uncertainty. Elections, social
causes, political agendas and new modes of online governance can now be influenced by a range of virtual
entities that can cajole and redirect opinions without affirming identity or allegiance. In the advent of the 2013
Australian Federal Election, the open source Twitter activity for the two main opposing political leaders was
examined in order to determine the manner in which information was diffused. The results showed phony online
personas, fake bots deploying automated Twitter dissemination, and deceptive Twitter strategies. New media
tolerates slacktivism, where Twitter users mistake auto-narrative for genuine political sentiment. This study
demonstrates the need to increase legitimacy and validity in micro-blogging forms of new media and the need
for multi-factor authentication.

Mobile IP technology considers as one of the buzzwords in world of wireless technology. Nowadays, a lot of Internet applications depend on this technology to deploy their services like VOIP, VANET and so on. However, the main goal of this technology is to maintain high connectivity among the mobile nodes. The assumption here is that the Mobile Node (MN) should remain connected to its Home Agent (HA) during its mobility from one scope to another. The new scope is called Foreign Agent (FA) whereby the Mobile node can remain connected (routed) to the original scope (HA) by getting a new IP from FA which is called Care of Address (CoA). This paper will address the certain aspects belonging to the Mobile IP technology such as Mobile IPV4 and its relationship to Mobile IPV6 and some advantages and disadvantages of using Mobile IP. Vi-Fi (Vehicle Wi-Fi) descried as one of most advanced technology of Mobile IP.