BotScan: An adaptive active probing approach for identifying live IoT Botnet C2 servers at scale

Abstract

How can we actively search and identify live C2 servers of botnets at scale? The scalability requirement introduces the need to utilize resources efficiently in terms of computation and number of probing packets. We propose BotScan, an approach for actively probing a large IP space to find the highest possible number of live C2 servers. The novelty of BotScan revolves around two insights, which we establish empirically. First, contrary to popular PC-centric observations, many modern IoT botnet communication protocols use packets with minimal customization, which we observe across six major families. Second, C2 servers exhibit exploitable behavioral patterns, such as strong spatial locality. We substantiate the first insight by developing a streamlined approach where, given malware binaries, we measure and taxonomize the "replayability" of its C2 communication protocol. Then, we introduce a behavior-adaptive probing strategy that: (a) exploits the spatial locality of C2 servers using a two-level segment-centric approach, and (b) adapts dynamically to the success of its probes. We validate the effectiveness of our method using 1,842 recently collected IoT binaries, and we explore a target space of 2.5M IP addresses. First, a replay-based method is applicable for at least 72% of the malware binaries. Second, our method outperforms baseline methods by finding approximately double the live C2 servers for the same number of probes. We also conduct two case-studies where we identify 896 live servers including 112 unreported C2 servers.