Intrusion Detection Mechanisms for PeertoPeer Networks Pratik Narang

Intrusion Detection Mechanisms for Peer-to-Peer Networks – Pratik Narang BITS Pilani Hyderabad Campus

Acknowledgements � Dr. Chittaranjan Hota (BITS – Pilani, Hyderabad) � Dr. V. N. Venkatakrishnan (University of Illinois at Chicago) � Dr. Nasir Memon (New York University, Abu Dhabi) � Supported by

Introduction What are P 2 P networks ? What’s a bot ? What are botnets ? What are Peer-to-Peer based botnets ?

Peer-to-Peers networks are distributed systems consisting of interconnected nodes are able to be self-organized into network topologies are built with purpose of sharing resources such as content, CPU cycles, storage and bandwidth Famous applications- � Bit. Torrent � Skype � e. Mule � SETI @ home

Peer-to-Peers networks P 2 P overlay layer C A F H G D B A E C E F H AS 1 AS 4 B AS 2 AS 6 D AS 3 G AS 5 Native IP layer

Generic P 2 P architecture Search API Overlay Messaging API Peer Role Selection Capability & Configuration Routing and Forwarding Neighbor Discovery Join/Leave Bootstrap NAT/ Firewall Traversal Operating System Content Storage

P 2 P: uses & misuses

Traditional Botnets Bot-Master

Peer-to-Peer Botnets Source: www. lightcyber. com

Dataset Botnet What it does? Type /Size of data Source of data Sality Infects executable files, attempts to disable security software. Binary (. exe) file Generated on testbed Storm Email Spam . pcap file/ 4. 8 GB Obtained from Univ. of Georgia Waledac Email spam, password stealing . pcap file/ 1. 1 GB Obtained from Univ. of Georgia Zeu. S Steals banking information by MITM key logging and form grabbing . pcap file/ 1 GB Obtained from Univ. of Georgia and CVUT Prague + Generated on testbed Nugache Email spam . pcap file/ 58 MB Obtained from University of Texas at Dallas and multiple P 2 P applications, web traffic, etc.

P 2 P apps v/s P 2 P bots Ø • • • Applications: Ø A human user – ‘bursty’ traffic • High volume of data transfers seen • Small inter-arrival time of packets seen in apps • Botnets: Automated / scripted commands Low in volume, high in duration Large inter-arrival time of packets seen in stealthy bots *Both randomize ports, use TCP as well as UDP

Approach Gather five-tuple flows from network traffic � Cluster flows based on bi-directional features � Conversations: IP 1, IP 2 For each tuple, extract 4 features : – – Protocol, Packets per sec (f/w), Packets per sec (b/w), Avg. Payload size (f/w), and Avg. Payload size (b/w) Create two-tuple conversations within each cluster � Flows: IP 1, IP 1 -port, IP 2 -port, protocol The duration of the conversation The number of packets exchanged in the conversation The volume of the conversation (no. of bytes) The Median value of the inter-arrival time of packets in the conversation Differentiate between and categorize P 2 P apps & bots with these features

Architecture Packet Filtering Module P 2 P traffic Flow Creation Module TIMEGAP Machine Learning based modules Conversation Generation Module FLOWGAP Valid packets Flows made from valid packets Discarded packets (Corrupted or missing headers) Clusters of flows Conversations classified as benign Conversations classified as malicious Flow Clustering Module

Data crunching

Results Performance of classifiers on test data Performance of classifiers on unseen P 2 P botnets Peer. Shark: Detecting P 2 P Botnets by Tracking Conversations. Presented at IEEE Security & Privacy Workshops (co-located with the 35 th IEEE Symposium on Security & Privacy), San Jose, USA, May 2014. (Pratik Narang, Subhajit Ray, Chittaranjan Hota and V. N. Venkatakrishnan). Peer. Shark: Flow-clustering and Conversation-generation for Malicious P 2 P traffic Identification. The EURASIP Journal on Information Security 2014, 2014: 15. (Pratik Narang, Chittaranjan Hota and V. N. Venkatakrishnan)

Other tracks

Signal-processing Techniques for P 2 P Botnet Detection Approach & Contributions: To uncover hidden patterns between the communications of bots, we convert the timedomain network communication of peers to the frequency-domain. We extract 2 -tuple conversations from network traffic and treat those conversations as a signal. We extract several ‘signal-processing’ based features using Fourier Transforms and Shannon's Entropy theory. We calculate: � FFT(inter-arrival_time)

Signal-processing Techniques for P 2 P Botnet Detection Packet Validation and Filtering Module P 2 P botnets identified Valid packets Conversation Creation Module Machine Learning based modules Discarded packets Extracted Features Malicious conversation Feature Set Extraction Module Signalprocessing based features Networkbehavior based features Benign conversation Machine-learning Approaches for P 2 P Botnet Detection using Signal-processing Techniques. The 8 th ACM International Conference on Distributed Event-Based Systems (DEBS’ 14), ACM SIGMOD/SIGSOFT, Mumbai, India, pp. 338 -341, May 2014.

Host-based approach using Hadoop Distributed Systems Lab Student Hostels 1. Data collection … 2. Parse Packets with Tshark 3. Push data to HDFS 4. Host-based features extracted with Hive Name node Data nodes Trigger Firewall rules 5. Feature set evaluated against models built with Mahout P 2 P bots detected Hades: A Hadoop-based Framework for Detection of Peer-to-Peer Botnets. The 20 th International Conference on Management of Data (COMAD) 2014, Hyderabad, Dec 2014. (Pratik Narang, Abhishek Thakur and Chittaranjan

Code: www. github. com/pratiknarang Feedback: pratiknarang@outlook. com