Using coverage analysis to extract Botnet command-and-control protocol
Zhanhui Wang · DOAJ (DOAJ: Directory of Open Access Journals) · 2014
There are some inherent patterns in the bot execution trace coverage of basic blocks.Using these patterns,an approach was proposed to infer Botnet command-and-control protocol (C&C protocol).Without intermediate representation of binary code and constraints solving,this approach has a lower time and space overhead.This coverage analysis approach was evaluated on 3 famous Botnet:Zeus,Sdbot and Agobot.The result shows that this approach can accurately and efficiently extract the Botnet control commands.And the completeness of the extracted control commands could be verified by checking whether all available basic blocks in bot are covered by the traces triggered by the control commands.