JACKSTRAWS: picking command and control connections from bot traffic

摘要: A distinguishing characteristic of bots is their ability to establish a command and control (C&C) channel. The typical approach build detection models for C&C traffic identify endpoints (IP addresses domains servers) execute bot in controlled environment monitor its outgoing network connections. Using the traffic, one can then craft signatures that match connections or blacklist IP packets are sent to. Unfortunately, this process not as easy it seems. For example, often open large number additional legitimate sites (to perform click fraud query current time), deliberately produce "noise" - bogus make analysis more difficult. Thus, before model domains, first has pick among all produces. In paper, we present JACKSTRAWS, system accurately identifies To end, leverage host-based information provides insights into which data over each connection well ways processes receives. More precisely, associate with behavior graph captures calls lead connection, operate on returned. By using machine learning techniques training set graphs associated known connections, automatically extract generalize templates capture core different types activity. Later, use these against produced by other bots. Our results show JACKSTRAWS detect even novel families were used template generation.