A multi-layered response system for botnets based on resilient complex social networks

Abstract

The present invention provides a multi-layered response system for botnets based on resilient complex social networks, including the introduction of a security framework, BotWard, for responding to botnets and enhancing network security, introducing anonymous command and control servers in social networks, hiding commands in diaries for covert communication, and using automatic reconfiguration mechanisms to improve resilience. The present invention sheds light on the complex workings of social media botnets, thereby enabling methods to detect and disrupt botnet operations, thereby enhancing the security of social platforms in the face of evolving network threats.

Description

Technical Field

[0001] The present invention relates to the field of network security and network defense technology, and in particular to a multi-layer response system for a botnet based on a flexible complex social network. Background Art

[0002] The ubiquity of social media platforms in the digital age has fundamentally changed the cyber threat landscape. With billions of people actively engaging in online social interactions, these platforms are no longer just venues for communication and content sharing, they have inadvertently become powerful vectors for cyberattacks such as botnets. Botnets, historically known for their centralized and decentralized architectures, have developed structures that are able to exploit the complexity and large user base of social networks. The shift from traditional botnet structures to those that effectively exploit social media is both ingenious and worrying. Social media botnets disguise their command and control (C&C) operations amid regular user activity, making detection a daunting challenge. Furthermore, by employing strategies that blend social engineering and data privacy violations, these botnets pose a multifaceted threat.

[0003] While considerable academic research has been devoted to detecting botnets through traditional methods, the special characteristics of social media botnets require innovative approaches. Given their ability to mimic real user behavior, dynamically generate pseudo-random nicknames, and quickly recover from disruptions, it is critical to understand how they work. Understanding the complex workings of social media botnets is needed to develop methods to detect and disrupt botnet operations, thereby strengthening the security of social platforms in the face of evolving cyber threats. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a multi-layer response system for botnets based on elastic complex social networks, illustrating the complex operation of social media botnets, thereby proposing methods that can not only detect but also disrupt their operations.

[0005] The above technical objectives of the present invention are achieved through the following technical solutions:

[0006] A multi-layer response system for botnets based on resilient complex social networks includes the introduction of a security framework BotWard, which is used to respond to botnets and enhance network security. The security framework BotWard introduces anonymous command and control servers in social networks, hides commands in diaries for covert communication, and uses an automatic reconfiguration mechanism to improve resilience.

[0007] The present invention is further configured as follows: the working method of the system comprises:

[0008] Botmaster Design:

[0009] Initially, the URL list is divided into three sets: S1, S2, and S3; S1 represents the set of URLs in dormant state, and the corresponding nicknames have not been registered; S2 includes URLs in valid state, and the corresponding nicknames have been successfully registered; S3 contains URLs in failed state, and the corresponding nicknames have been registered but invalid; the threshold of C&C server load is set to zero, and the load of the C&C server corresponding to the i-th element in the URL list is denoted as Ci;

[0010] In order to evaluate the status of BotWard and enhance its ability to resist attacks, the following indicators are introduced:

[0011] Load ratio α: α = Ci / P, which is limited by the threshold γ;

[0012] Alarm rate β: The calculation formula is β = ∑(α≥α|s2) / |A2|, where ∑(α≥α|s2) represents the count of elements in S2 that satisfy the condition α≥α, that is, the load rate exceeds the threshold, and the threshold of β is denoted by γ;

[0013] Failure rate γ: The calculation formula is γ = |s3| / length, where the threshold value of γ is denoted as γ, and length corresponds to the length of the URL list generated by the nickname generation algorithm NGA.

[0014] The present invention is further configured as follows: the working method of the system further comprises:

[0015] C&C channels improve concealment:

[0016] The process of BotWard issuing instructions includes the following six steps:

[0017] Step 1: Preprocessing: Botmaster encrypts the instructions, adds a digital signature, and generates a cipher text;

[0018] Step 2: Information hiding: Botmaster embeds the password text into the attribute field of a special web page tag and inserts this tag into the regular log;

[0019] Step 3: HTTP POST: Botmaster uploads logs to the C&C server using HTTP POST method.

[0020] Step 4: HTTP GET: Bot uses HTTP GET method to download logs from the C&C server.

[0021] Step 5: Information extraction: Bot locates special web page tags in the log and extracts the password text from its attribute domain;

[0022] Step 6: Post-processing: Bot first verifies the Botmaster’s signature. If the verification is successful, it proceeds to decrypt the message; otherwise, the message is discarded.

[0023] The present invention is further configured as follows: the working method of the system further comprises:

[0024] Nickname generation:

[0025] The nickname generation algorithm, or NGA, depends on two input parameters, seed and length; the following is the nickname generation algorithm:

[0026]

[0027]

[0028] The present invention is further configured as follows: the working method of the system further comprises:

[0029] Bot Design:

[0030] The bot's actions are based on nickname generation algorithms, nickname lists, and URL lists.

[0031] The present invention is further configured as follows: the working method of the system further comprises:

[0032] Monitor the real-time status of BotWard: the total number of bots and the number of controllable bots in regular sampling experiments.

[0033] The present invention has the following beneficial effects:

[0034] The BotWard introduced in this invention is an innovative botnet framework based on social networks, in which a unique anonymized command and control server (C&C server) is deployed in the social network. The automatic reconfiguration mechanism of BotWard enhances resilience, provides early warning and automatic recovery of damaged C&C communications, and maintains a 100% control rate. Experiments have confirmed the effectiveness of BotWard's ability to quickly restore C&C communications even in the face of complete C&C server failure, thereby verifying the proposed robot network nickname identification technology. By effectively addressing the challenges of botnets based on social networks, this research significantly enhances network security through practical and powerful measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a nickname generation model and a zombie nickname detection method; Figure 1It is shown in Figure 2 that social botnets dynamically generate pseudo-random nicknames based on a custom algorithm for registering C&C servers and have strong resistance to sabotage. However, there are important differences in lexical features between pseudo-random bot nicknames generated by the same algorithm and the legitimate nicknames registered by most users. This difference can usually be reflected in the different distribution rules of common substrings in the two nicknames. DETAILED DESCRIPTION

[0036] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0037] A multi-layered response system for botnets based on resilient complex social networks, the technical field of which lies in the field of network security and network defense in complex social networks. Although extensive research and development have been conducted in this field, insufficient attention has been paid to fake nicknames in complex social networks.

[0038] Botnets pose a serious security threat in the context of complex social networks characterized by diverse and interconnected interactions, so this application introduces an innovative framework, BotWard, designed to counter botnets and enhance network security in these environments. BotWard introduces anonymous command and control servers in social networks, hides commands in diaries for covert communication, and uses automatic reconfiguration mechanisms to improve resilience.

[0039] The working method of the system in this application includes:

[0040] 1.Botmaster design.

[0041] Initially, the URL list is divided into three sets: S1, S2, and S3. In this classification, S1 represents a set of URLs in a dormant state, and the corresponding nicknames have not been registered. S2 includes URLs in a valid state, and their corresponding nicknames have been successfully registered. S3 contains URLs in a failed state, and the corresponding nicknames have been registered but invalid. In addition, the threshold of the C&C server load is set to zero, that is, if the load of the C&C server exceeds zero, the value is considered invalid. The load of the C&C server corresponding to the i-th element in the URL list is denoted as Ci.

[0042] In order to evaluate the status of BotWard and enhance its ability to resist attacks, the following indicators are introduced:

[0043] Load ratio α: α = Ci / P, which is limited by the threshold γ;

[0044] Alarm rate β: The calculation formula is β = ∑(α≥α|s2) / |S2|, where ∑(α≥α|s2) represents the count of elements in S2 that satisfy the condition α≥α, that is, the load rate exceeds the threshold, and the threshold of β is denoted by γ;

[0045] Failure rate γ: The calculation formula is γ = |s3| / length, where the threshold value of γ is denoted as γ, and length corresponds to the length of the URL list generated by the nickname generation algorithm NGA.

[0046] These indicators are crucial for evaluating and improving BotWard's ability to resist threats. Botmaster first calls NGA once to retrieve the current nickname list and URL list, and then selects a random part. The nickname registration process is then carried out, and these indicators begin to be monitored periodically. When β ≥ β- is observed, it means that the load of the C&C server has reached its maximum capacity, and Botmaster will issue a beta alert to notify the attacker of new registrations. In addition, Botmaster sends a balancing command to evenly distribute the load to each C&C server.

[0047] When the monitoring of γ exceeds the gamma threshold, it means that there are a large number of invalid URLs in the URL list, making it impractical to control large-scale bots. In response, Botmaster will send a γ alert to notify the attacker to update the seed and start a new batch of pre-registered nicknames.

[0048] 2. Command and control channels

[0049] The C&C channel is responsible for transmitting the botnet's internal messages. In order to prevent third parties from issuing instructions or eavesdropping on C&C communications, attackers usually use digital signatures and encryption technologies to ensure communication security. However, BotWard's instructions are sent on a social networking platform accessible to all users. Therefore, its C&C channel must also prioritize high concealment to avoid users reporting that the C&C server has posted malicious messages, which would lead to its being blocked. The process of issuing instructions includes the following six steps:

[0050] Step 1: Preprocessing: Botmaster encrypts the instructions, adds a digital signature, and generates a cipher text;

[0051] Step 2: Information hiding: Botmaster embeds the password text into the attribute field of a special web page tag and inserts this tag into the regular log;

[0052] Step 3: HTTP POST: Botmaster uploads logs to the C&C server using HTTP POST method.

[0053] Step 4: HTTP GET: Bot uses HTTP GET method to download logs from the C&C server.

[0054] Step 5: Information extraction: Bot locates special web page tags in the log and extracts the password text from its attribute domain;

[0055] Step 6: Post-processing: Bot first verifies the Botmaster’s signature. If the verification is successful, it proceeds to decrypt the message; otherwise, the message is discarded.

[0056] All keys are pre-coded in the Botmaster and Bot programs, and no key distribution is required. This method not only prevents third parties from impersonating Botmasters and eavesdropping on C&C communication content, but also cleverly hides C&C messages in social network logs, ensuring a high level of security.

[0057] 3. Nickname generation

[0058] The Nickname Generation Algorithm (NGA) plays a vital role in the collaborative operation of BotMaster and Bot. The algorithm is hard-coded into BotMaster and Bot to ensure that the generated nicknames are synchronized and consistent. The NGA algorithm relies on two input parameters:

[0059] Seed (parameter 1): This is a numeric character used as the initial value of the algorithm. The purpose of the seed is to establish a common starting point for generating nicknames. In order to ensure synchronization of the nickname lists created by the BotMaster and the Bot, a string is needed as a reference. This string can be derived from various sources, such as a list of URLs, search engine results, keyword records, or social network hot topic rankings.

[0060] Length (parameter 2): The length parameter is an integer value that determines the length of the output generated by the NGA algorithm. This length parameter must be consistent across the nickname list and URL list. The algorithm generates an encoded pseudo-random string with the length specified by this parameter. The purpose of this encoding is to make the generated nicknames more resistant to correlation and semantic analysis by potential defenders or security systems.

[0061] These nicknames are generated for specific purposes. One of the main uses is to register on the C&C server, and they are also used as URLs on social networks to access the C&C server.

[0062] The following is the nickname generation algorithm:

[0063]

[0064]

[0065] 4.Bot Design

[0066] The Nickname Generation Algorithm (NGA) is the first step for the Bot to start performing actions. With this request, the Bot retrieves the current nickname list and URL list, which together form the basis for the Bot to operate. These lists provide the Bot with the knowledge and resources it needs to perform its work. When the failure rate variable γ, which represents the URL list, reaches a predefined threshold, the Bot will not be idle, it will actively perform specific actions. The Bot will adjust its seed value to cope with this situation and then start the NGA again. To ensure that the Bot continues to access the information and resources required to perform its tasks, this step will attempt to obtain a new batch of nickname lists and URL lists.

[0067] The URL list and nickname list play a vital role in the Bot's functionality. The Bot's operation depends on these lists, and it uses them in a random manner to connect to the command and control (C&C) server through the URL list. When the connection is established, the Bot initiates a conversation process, which allows it to easily contact the C&C server. In addition, the Bot runs routine log analysis commands on the C&C server to keep abreast of the latest instructions and ensure that they are followed during operation.

[0068] During a session, if the Bot receives a balance command from the Botmaster, it terminates the session immediately. To handle potential algorithm failures or iterations, the URL list is automatically pruned. Specifically, elements from the 14th to the 16th position (about 16) are sequentially deleted from the initial URL list. Therefore, the number of elements of S3, denoted as s3, can be expressed as s3 = length - |URL list|. This calculation allows us to equivalently define the failure rate γ in the third line:

[0069] γ=(length-|URL list|) / length=1-(|URL list| / length)

[0070] In this specific context, γ plays a key role as a threshold that determines whether the Bot should refresh its nickname list and URL list. This proactive measure ensures that the Bot can communicate with the C&C server effectively and reliably. In summary, the Bot's actions are built on the nickname generation algorithm and the associated nickname list and URL list. They enable the Bot to connect, communicate, and respond appropriately to changing situations.

[0071] 5. Monitor the real-time status of BotWard

[0072] The total number of bots and the number of controllable bots in the regular sampling experiment. The experimental process can be divided into the following stages:

[0073] Infection phase (0-200 seconds): This phase corresponds to the growth period of the BotWard scale. The entire growth process is similar to the spread of human infectious diseases and shows an S-shaped growth trend. In the initial stage of infection (0-100 seconds), the number of Bots is small, the two curves mostly overlap, and the control rate remains at 100%. At the peak of infection (100-150 seconds), a large number of Bot activities cause some C&C servers to be overloaded, resulting in varying degrees of failure, thus reducing the number of controllable Bots. As new C&C servers are created, control over out-of-control Bots is gradually restored. Therefore, in this stage, the control rate fluctuates. At the end of the infection phase (150-250 seconds), the number of newly infected Bots gradually decreases, the two curves overlap again, and the control rate basically recovers to 98.9%.

[0074] Stable stage (250-700 seconds): In this stage, no new bots are introduced and the total number of bots remains at 1,000.

[0075] To further evaluate the invulnerability of BotWard, a scenario was created where all C&C servers failed for a short period of time, resulting in a decrease in the number of controllable bots. When the number of controllable bots dropped to zero, a buffer period (330-420 seconds) occurred. During this period, the number of controllable bots remained at zero due to the failure of the C&C servers. BotMaster actively monitored the failure of all C&C servers and quickly created new C&C servers after the buffer period. Subsequently, BotWard entered a phase from 410 to 550 seconds, which was different from the exponential growth observed in the infection phase (0-250 seconds). In this phase, all bots were active, but they just randomly searched for valid C&C server connections, resulting in a linear growth trend. Eventually, BotWard recovered to a stable period (550-700 seconds) in which the control rate reached 100%, consistent with the length of the recovery period and the polling cycle of the bots. The simulation results clearly demonstrated the superior invulnerability of BotWard.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A multi-layered response system for botnets based on elastic complex social networks, characterized by: Including the introduction of a security framework BotWard, which is used to deal with botnets and enhance network security. The security framework BotWard introduces anonymous command and control servers in social networks, hides commands in diaries for covert communication, and uses an automatic reconfiguration mechanism to improve resilience; the multi-layer response system includes a collection module, a nickname database, a mining module, a learning module, and a detection module; The acquisition module is used to collect user nicknames from social networks and botnets that are introduced into the anonymous command and control server by the security framework BotWard, and send them to the nickname database; The nickname database is used to receive and store all nicknames, including legitimate nicknames or zombie nicknames; The mining module is used to extract trained legal nicknames from the nickname database, and extract features from them to form a feature table and send it to the learning module; The learning module receives the feature table to train the system and improve the system's ability to detect legitimate nicknames and zombie nicknames; The detection module uses the training data and credibility threshold from the learning module to finally verify the nicknames in the nickname database and define whether the nicknames belong to legitimate nicknames or zombie nicknames; The working method of the system includes: Botmaster Design: Initially, the URL list is divided into three sets: S1, S2, and S3; S1 represents the set of URLs in dormant state, and the corresponding nicknames have not been registered; S2 includes URLs in valid state, and the corresponding nicknames have been successfully registered; S3 contains URLs in failed state, and the corresponding nicknames have been registered but invalid; the threshold of C&C server load is set to zero, and the load of the C&C server corresponding to the i-th element in the URL list is denoted as Ci; In order to evaluate the status of BotWard and enhance its ability to resist attacks, the following indicators are introduced: Load ratio α: α = Ci / P, which is limited by the threshold γ; Alarm rate β: The calculation formula is β = ∑(α≥α|s2) / |s2|, where ∑(α≥α|s2) represents the count of elements in s2 that satisfy the condition α≥α, that is, the load rate exceeds the threshold, and the threshold of β is denoted by γ; Failure rate γ: The calculation formula is γ = |s3| / length, where the threshold value of γ is denoted as γ, and length corresponds to the length of the URL list generated by the nickname generation algorithm NGA; The working method of the system also includes: C&C channels improve concealment: The process of BotWard issuing instructions includes the following six steps: Step 1: Preprocessing: Botmaster encrypts the instructions, adds a digital signature, and generates a cipher text; Step 2: Information hiding: Botmaster embeds the password text into the attribute field of a special web page tag and inserts this tag into the regular log; Step 3: HTTP POST: Botmaster uploads logs to the C&C server using HTTP POST method. Step 4: HTTP GET: Bot uses HTTP GET method to download logs from the C&C server. Step 5: Information extraction: Bot locates special web page tags in the log and extracts the password text from its attribute domain; Step 6: Post-processing: Bot first verifies the Botmaster's signature. If the verification is successful, it continues to decrypt the message; otherwise, the message is discarded; The working method of the system also includes: Bot Design: Bot actions are based on nickname generation algorithms, nickname lists, and URL lists; The working method of the system also includes: Monitor the real-time status of BotWard: the total number of bots and the number of controllable bots in regular sampling experiments.

Images