D-BitBot: a P2P duplex botnet model in Bitcoin network

Abstract:

Botnets choose blockchain networks (such as Bitcoin and Ethereum) as the communication channel for their command-and-control (C&C) mechanism because blockchain networks are anonymous and hard to shut down. Recent research focuses on this mechanism, but the research methods have such defects that the scalability is restricted, and the upstream channel is vulnerable to existing tracing techniques. To solve these problems, D-BitBot, a peer-to-peer (P2P)-based duplex botnet model which utilizes the Bitcoin testnet as the upstream channel is proposed in this paper. The C&C channel used in this model is hard to trace and reduces the cost of data recovery and network scalability. To avoid single point of failure in traditional botnet bootstrap procedure, a Bitcoin blockchain based bootstrap mechanism is presented. Further, to defend against direct routing table poisoning and P2P botnet crawling, a novel peer list exchange algorithm based on the sorted hash values of IP addresses and random salt values is proposed. According to the result of P2P simulation, D-BitBot provided robust network connectivity with an online rate of 100%. In the node request and node crawling algorithm, the proposed algorithm was effective against direct routing table poisoning and reduced the node detection rate of the current crawling algorithm. Lastly, possible countermeasures and the robustness of the proposed C&C channel were discussed at the end of this paper.