6th European Conference - Academic Conferences

Towards an Intelligent Software Agent System as Defense
Against Botnets
Evan Dembskey and Elmarie Biermann
UNISA, Pretoria, South Africa
French South African Institute of Technology CPUT, Cape Town, South Africa
Dembsej@unisa.ac.za
bierman@xsinet.co.za
Abstract: Computer networks are targeted by state and non-state actors and criminals. With the
professionalization and commoditization of malware we are moving into a new realm where off-the-shelf and
time-sharing malware can be bought or rented by the technically unsophisticated. The commoditization of
malware comes with all the benefits of mass produced software, including regular software updates, access to
fresh exploits and the use of hack farms. To an extent defense is out of the hands of the government, and in the
hands of commercial and private hands. However, the cumulative effect of Information Warfare attacks goes
beyond the commercial and private spheres and affects the entire state. Thus the responsibility for defense
should be distributed amongst all actors within a state. As malware increases and becomes more sophisticated
and innovative in their attack vectors, command & control structures and operation, more sophisticated,
innovative and collaborative methods are required to combat them. The current scenario of partial protection due
to resource constraints is inadequate. It is thus necessary to create defence systems that are robust and resilient
against known vectors and vectors that have not previously been used in a manner that is easy and cheap to
implement across government, commercial and private networks without compromising security. We argue that a
significant portion of daily network defence must be allocated to software agents acting in a beneficent botnet
with distributed input from human actors, and propose a framework for this purpose. This paper is based the
preliminary work of a PhD thesis on the topic of using software agents to combat botnets, and covers the
preliminary literature survey and design of the solution. This includes a crowd sourcing component that uses
information about malware gained from software agents and from human users. Part of this work is based on
previous research by the authors. It is anticipated that the research will result in a clearer understanding of the
role of software agents in the role of defence against computer network operations, and a proof-of-concept
implementation.
Keywords: information warfare, Botnet, software agent
1. Introduction
We propose to use distributed software agents (SA) as a method for overcoming botnets and other
malware in the area of Information Warfare (IW). This area of research is important due to the growing
threat posed by malware. This research addresses some of the long term research goals identified by
the US National Research Council (National Research Council (U.S.). Committee on the Role of
Information Technology in Responding to Terrorism et al. 2003) and four of the ten suggested
research areas in (Denning, Denning 2010). It is an extension and refinement of research undertaken
to determine if an IW SA agent framework is viable (Dembskey, Biermann 2008).
Malware is a reality of networked computers and is being increasingly used by state, criminal and
terrorist actors as weapons, vectors for crime and tools of coercion. While it is debatable whether a
digital Pearl Harbour is a genuine possibility (Smith 1998), it is agreed that malware is on the increase
and is being commoditized (Knapp, Boulton 2008, Microsoft 2010, Dunham, Melnick 2009), though
there is some dissent on this point (Prince 2010). Technically unsophisticated users can purchase
time on existing botnets to accomplish some goal, e.g. phishing attacks, spamming, or the denial,
destruction or modification of data.
A botnet is a distributed group of software agent-like bots that run autonomously and automatically,
usually without the knowledge of the computers owner. Botnets are usually, but not necessarily,
malicious. The purpose of botnets is not necessarily destructive; it is often financial gain, which results
in a very different approach to development and Command & Control. An effective process of
prevention, detection and removal will mitigate botnets regardless of their purpose.
IW is warfare that explicitly recognises information as an asset. Computer Network Operations (CNO)
is a form of IW that uses global computer networks to further the aims of warfare. CNO is divided into
Computer Network Attack (CNA) and Computer Network Defence (CND). Increasingly, politically
motivated cyber attacks are focusing on commercial and not government infrastructure (Knapp,
298