Host attack graph model reveals key factors for botnet spread
Host Attack Graph for Botnet Propagation
Cryptography and SecurityComputer Science and Game TheoryNetworking and Internet Architecture
Summary
Botnets are networks of infected computers that attackers use to overwhelm or spy on other computer systems. This paper introduces a way to model how these botnets spread by looking at individual computers as points in a network called host attack graphs. The authors test different strategies for spreading botnets and find that while the size of the botnet and how it attacks matter, the shape of the network and which targets it picks are also very important. Their work helps better understand how botnets grow and what influences their speed.
What this means in practice
- •For network security teams: Predict which network structures are more vulnerable to botnet attacks by simulating propagation with host attack graphs to prioritize defenses.
- •For cyber threat analysts: Improve detection and mitigation strategies by understanding how botnet size, attack strategies, and target choices impact spread over time.
Authors
Andrei Neagu, Mara-Cristina Sterian, Paul Irofti
Abstract
Botnets represent the backbone of most modern cybersecurity attacks through which botmasters deploy distributed denial of service and advanced persistent threats against legitimate computer networks. In this paper we introduce the Host Attack Graph model and propose two botnet propagation strategies which we study across network topologies, target selection, and attack strategies together with their effectiveness in time. While strategy and botnet size are important for propagation, our study and simulations show that network topology and target selection should not be easily discarded. Implementation and benchmarks are available at https://codeberg.org/AndreiN/HAGP.