One IOTA of Countless Legions: A Next-Generation Botnet Premises Design Substrated on Blockchain and Internet of Things

Although botnet had been at the top of the list of main threats to the cyber world for an extended period of time, its harmfulness has been constrained nowadays due to the development of kaleidoscopic network security enforcing tools and people’s increasing awareness. And the underlying technology of the botnet has been stagnant ascribing to many drawbacks such as inadequate protection of the identity of the Botmaster and weak resilience of the botnet’s infrastructure. In this article, we first introduce a new classification of the botnet based on botnets’ underlying network, then briefly analyze the main flaws of the traditional botnet and some looming Blockchain-based botnets, with pros and cons of leveraging Blockchain to construct botnets. Furthermore, we propose one IOTA of countless legions (OICL), a newfangled versatile botnet infrastructure that overcomes the bottlenecks that other contemporaries cannot eliminate. It leverages Blockchain, also known as distributed ledger technology (DLT), to be its premises and uses many advantages of it without paying too many tradeoffs. Also, we invent a whole set of communication protocols for OICL and a novel scheme called Proof of Honest (PoH) to identify the espionage infiltrated into the botnet to further promote the robustness. In addition, we discover and propose a mechanism called collateral damage binding (CDB), which proves that the botnet has it such as OICL is far more robust than those who do not. Performance evaluations show that OICL is effective, more cost-saving, and fast-responding compared with the Bitcoin-based botnets as baselines.

I. Introduction

Botnet, rendered as a relentless threat to the digital world, is like a ghost that changes in form or shape but never dissipates. Since the first Internet relay chatting (IRC)-based botnet emerged in 1993, it has become a dangerous threat that is difficult to detect and dismantle [1] from time to time. The botnet is a network of compromised machines, individually referred to as bots or zombies, and controlled remotely by a malicious entity known as the Botmaster. For decades, the most everlasting characteristic of the botnet is its large scale, i.e., the number of victims can reach up to or more than 10000 [2], such as Srizbi [3], Shamoon [4], Kraken [5], Zeus [6], [7], Retadup [8], [9], etc. Thereafter, added with new features of specialization and fine-grained control, botnets are evolving and tailored continuously to fit the advanced persistent threat (APT) [10], a stealthy threat actor, typically a nation-state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period.