We gratefully acknowledge support from
the Simons Foundation and member institutions.
Full-text links:

Download:

Current browse context:

cs.CR

Change to browse by:

cs

References & Citations

DBLP - CS Bibliography

Bookmark

(what is this?)
CiteULike logo BibSonomy logo Mendeley logo del.icio.us logo Digg logo Reddit logo ScienceWISE logo

Computer Science > Cryptography and Security

Title: Devils in the Clouds: An Evolutionary Study of Telnet Bot Loaders

Abstract: One of the innovations brought by Mirai and its derived malware is the adoption of self-contained loaders for infecting IoT devices and recruiting them in botnets. Functionally decoupled from other botnet components and not embedded in the payload, loaders cannot be analysed using conventional approaches that rely on honeypots for capturing samples. Different approaches are necessary for studying the loaders evolution and defining a genealogy. To address the insufficient knowledge about loaders' lineage in existing studies, in this paper, we propose a semantic-aware method to measure, categorize, and compare different loader servers, with the goal of highlighting their evolution, independent from the payload evolution. Leveraging behavior-based metrics, we cluster the discovered loaders and define eight families to determine the genealogy and draw a homology map. Our study shows that the source code of Mirai is evolving and spawning new botnets with new capabilities, both on the client side and the server side. In turn, shedding light on the infection loaders can help the cybersecurity community to improve detection and prevention tools.
Comments: 10 pages, 5 figures, ICC 2023. arXiv admin note: text overlap with arXiv:2206.00385
Subjects: Cryptography and Security (cs.CR)
Cite as: arXiv:2211.14790 [cs.CR]
  (or arXiv:2211.14790v1 [cs.CR] for this version)

Submission history

From: Yuhui Zhu [view email]
[v1] Sun, 27 Nov 2022 11:07:37 GMT (2378kb,D)

Link back to: arXiv, form interface, contact.