6th European Conference - Academic Conferences

Evan Dembskey and Elmarie Biermann
Darknets are most useful as global resource for sites and groups working against botnets on an
Internet-wide basis (Schiller, Binkley & Harley 2007). A honeypot is a decoy system set up to attract
attackers and study their methods and capabilities. A honeynet is usually defined as consisting of a
number of honeypots in a network, offering the attacker real systems, applications, and services to
work on and monitored transparently by a Layer 2 bridging device (honeywall). A static honeynet can
quickly be spotted and blacklisted by attackers, but distributed honeynets attempt to address that
issue and are likely to capture richer, more varied data (Schiller, Binkley & Harley 2007). In contrast to
honeynets, darknets do not advertise themselves.
Botnets, the malware we are interested in, are difficult to combat for the following reasons (Bailey et
al. 2009):
All aspects of the botnet’s life-cycle are all evolving constantly.
Each detection technique comes with its own set of tradeoffs with respect to false positives and
false negatives.
Different types of networks approach the botnet problem with differing goals, with different
visibility into the botnet behaviours, and different sources of data with which to uncover those
behaviours.
A successful solution for combating botnets will need to cope with each of these realities and their
complex interactions with each other.
4. Software agents
A software agent is a program that autonomously acquires, manipulates, distributes and maintains
information on behalf of some entity. We reject the trend of labeling software utilities such as
aggregators and download managers as SA; we base our definition on the properties of the software.
The literature defines a large number of agent properties. Not all properties are found in all agents,
but an in order to be termed Agent software must satisfy some minimum set of these properties. Bigus
and Bigus (Bigus, Bigus 2001) suggest that these are autonomy, intelligence and mobility. These
properties are defined as follows:
Autonomy - The autonomous agent exercises control over its own actions and has some degree
of control over its internal state. It displays judgment when faced with a situation requiring a
decision, and makes a decision without direct external intervention.
Intelligence - This does not imply self-awareness, but the ability to behave rationally and pursue a
goal in a logical and rational manner. Intelligence varies between simple coded logic and complex
AI-based methods such as inferencing and learning.
Mobility- Mobility is the degree to which agents move through the network. Some may be static
while others may migrate as the need arises. The decision to move should be made by the agent
(Murch, Johnson 1999), thus ensuring the agent has the property of autonomy.
From these properties we can judge that SA have potential applications in dealing with tasks that are
ill-defined or less structured. It is also apparent that SA interact with their task environments locally;
the implication of this is that the same agent can exhibit different behaviour in different environments
(Liu 2001). Padgham & Winikoff ((Padgham, Winikoff 2004)) provide a list of reasons why agents are
useful, including loose coupling, decentralisation, persistence, better functioning in open and complex
systems and reactiveness as well as proactivness. The use of SA to combat botnets is not
unprecedented. It had already been suggested that AF.MIL should be purposely made part of a
botnet ((Williams 2008)). Some researchers see botnets as types of SA ((Bigus, Bigus 2001)). Other
researchers ((Stytz, Banks 2008)) have begun to work on the problem of implementing such an
approach.
5. Proposed system
Vulnerabilities are introduced in software deliberately or accidently during development, or via
software or configuration changes during operation. Botnets are not typically introduced during
software development and thus require later introduction, and usually unintentionally. Possible vectors
of infection are viruses, worms and Trojans. These may be introduced via email, download, drive-by
download, network worm or some external storage device. According to (Cruz 2008) the majority of
infections occur due to downloads (53%) and infection via other malware (43%). Email and
removable drives account for 22% of infections. Instant Messaging, vulnerabilities, P2P, iFrame
301