Summer Research Fellowship Programme-2015 Indian Academy of Sciences, Bangalore PROJECT REPORT AUTOMATED CONTROL OF DISTRIBUTED SYSTEMS UNDER THE GUIDANCE OF Dr. B.M MEHTRE Associate Professor, Head, Center for Information Assurance and Management (CIAM) Institute for Development and Research in Banking Technology (IDRBT), Hyderabad - 500 057 Submitted by: S. NIVEADHITHA II Year, B Tech Computer Science Engineering SRM University, Kattankulathur, Chennai. SRF- ENGS7327 (2015) Indian Academy of Sciences, Bangalore CERTIFICATE This is to certify that Ms S Niveadhitha, Student, Second year B Tech Computer Science Engineering, SRM University, Kattankulathur, Chennai has undertaken Summer Research Fellowship Programme (2015) conducted by Indian Academy of Sciences, Bangalore at IDRBT, Hyderabad from May 25, 2015 to July 20, 2015. She was assigned the project “Automated Control of Distributed Systems” under my guidance. I wish her all the best for all her future endeavours. Dr. B.M MEHTRE Associate Professor, Head, Center for Information Assurance and Management (CIAM) Institute for Development and Research in Banking Technology (IDRBT), Hyderabad - 500 057 ACKNOWLEDGMENT I express my deep sense of gratitude to my Guide Dr. B. M. Mehtre, Associate Professor, Head, CIAM, IDRBT, Hyderabad - 500 057 for giving me an great opportunity to do this project in CIAM, IDRBT and providing all the support. I am thankful to Prof. Dr. B.L.Deekshatulu, Adjunct Professor, IDRBT for his guidance and valuable feedback. I am grateful to Mr. Hiran V Nath, Miss Shashi Sachan and colleagues of CIAM, IDRBT who constantly encouraged me for my project work and supported me by providing all the necessary information. I am indebted to Indian Academy of Sciences, Bangalore, Director, E & T SRM University, and Head, CSE, SRM University, Kattankulathur, Chennai for giving me this golden opportunity to undertake Summer Research Fellowship Programme at IDRBT. Finally I thank my parents and brother for their timely support. S. NIVEADHITHA Student, Second Year - B Tech Computer Science Engineering SRM University, Kattankulathur, Chennai. SRF- ENGS7327 (2015) Indian Academy of Sciences, Bangalore ABSTRACT: In today’s world of high demand on resources, it is very important that the resources are used judiciously. Computers play a very important role in development of any organization. In every large organization, it is said that nearly 60% of their processing power is not used at a particular time. Such distributed systems can be put together in performing a very large computation process. But manual control of these distributed systems is a tough and time consuming task. Hence the process to automate the control of these systems has been proposed. This would make optimum usage of various resources needing less man-power. There are many applications of this proposed architecture, ethical hacking, vulnerability assessment and penetration testing. As one of the applications of this Automated System, we have introduced the architecture to make Botnet-based DDoS attacks plausible. Botnet-based DDoS attacks on the application layer reign the Cyber Security world. The application layer limits resources thus, restrains revenue when Botnet Based DDoS attacks are performed. Though such attacks are usually done with a bad intention, these could be used positively to check vulnerabilities in our own network peripherals. There are many kinds of Botnet Architecture presently being used for DDoS. But many of them can be identified by Intrusion Detection System (IDS). Checking vulnerabilities against IDS becomes the need of the hour. This architecture stands out when compared to the prevalent model that uses IRC in many ways such as ease of set-up, improved reporting, concealment of traffic etc. Also DDoS attacks are the ones wherein many systems perform assigned tasks at the same time. Manually controlling these systems becomes rather a Herculean task. Hence in this project we try to implement (A) Automatic Control of Distributed Systems---control all the systems on attack procedure. (B) An architecture of Botnet based DDoS attack which is least detected by any Intrusion Detection System (IDS). INDEX Chapter Page Title No. No. 1 INTRODUCTION 1 2 BACKGROUND DETAILS 1 2.1 Botnet 1 2.1.1 Taxonomy of Botnet 2 2.2 DDoS 3 2.2.1 Types of DDoS attacks 3 2.2.2 Steps in DDoS attacks 4 2.3 Botnet in DDoS 7 2.4 SOCKS: A Protocol for TCP Proxy across Firewall 8 2.5 The Onion Router 8 2.5.1 TOR Network 9 3 SYSTEM ARCHITECTURE 10 3.1 Experimental Setup 11 4 DETECTION TECHNIQUES 11 5 IMPLEMENTATION DETAILS 12 6 RESULT and CONCLUSION 12 7 FUTURE WORKS 12 References 13 Appendix- A “Literature Survey on Digital Forensics and 15 Anti-Forensics” LIST OF FIGURES: S No. Title Page No. 2.1 Botnet Architecture 1 2.2 DDoS Architecture 3 2.3 Central Source Propagation 5 2.4 Back-Chaining Propagation 6 2.5 Autonomous Propagation 6 2.6 Agent handler Model 7 2.7 IRC Model 7 2.8 TOR Network 9 3.1 System Architecture 10 1. INTRODUCTION: The rapid usage of the Internet over the past few years have facilitated an increase in the incidents of online attacks [1]. One of the most vexing cyber-security threats today is the use of very large, coordinated groups of hosts for brute-force attacks, intrusions, and generating unsolicited emails.[2] The denial of service (DoS) attack is one such powerful attack.If the attack is distributed, it leads to a very significant damage to the network. A distributed DoS (DDoS) attack is launched by a mechanism called Botnet through a network of controlled computers.[3] Vulnerable hosts are turned into so-called zombies which can be controlled from afar. A collection of zombies called bots, when controlled by a single command and control (C2) infrastructure, form what is called a Botnet. In this paper we try to provide information on how Botnet facilitate DDoS attacks that hamper the Web server. Botnets compromise a network of machines with programs (usually referred to as a bot, zombie, or drone) and implement under a command and control (C&C) management infrastructure.[3] There are many existing architectures for Botnet based DDoS attack. According to Esraa Alomari et.al they are: (a) Agent-Handler Model (b) Internet Relay Chat (IRC) Model and (c) Web- based Model. Our aim is to design architecture of Botnet based DDoS attack such that the attack is not detected by an Intrusion Detection System (IDS). 2. BACKGROUND DETAILS: 2.1 Botnet: Fig:2.1 Botnet Architecture Botnet is a network of compromised computers called “Bots” under the remote control of a human operator called “Botmaster”. The term “Bot” is derived from the word “Robot”; and similar to robots, bots are designed to perform some predefined functions in automated way.[7] The Command and Control Server(C&C) controls the mechanism. 2.1.1 Taxonomy of Botnets According to Chao Li et.al Taxonomy of botnets is as follows A. Infection Mechanism [9] There are various types of methods for attacker to distribute a particular bot. Basudev et al. [8] discussed three methods of bots propagation. 1) Web Download: Web-based malware creates botnet-like structures in which compromised machines query web servers periodically for instructions and updates. [8] 2) Mail Attachments: E-mail attachments with mass mailing worms can contain bots. Spam techniques simplify and enable fast spreading of bots easily. 3) Automatically Scan Exploit and Compromise: The bots automatically infect the host that has vulnerabilities. B. Botnet Malicious Behavior [9] 1) Compromising new hosts: The Botmaster recruits new hosts to make the botnet stronger. 2) Denial of service attack: The Botnet always contains a set of flooding mechanisms, such as SYN flood, ICMP flood, and HTTP flood, for sending those packets to the targeted network, or just sending thousands of legitimate http, ftp requests to the site. 3) Spam: Spam bots can use the SMTP server to send spam on attacker’s will. Phatbot is one such bot widely being used for spamming. 4) Phishing: In most case, bots can be used to host phishing sites. Attackers can extract information from bots by turning them into web servers or DNS servers to conduct phishing. 5) Steal sensitive data: Botmaster can easily collect victims’ passwords and credentials by the processes of screen capture, password theft, file upload and key-logging software. C. Command and Control Models [9] 1) Centralized C&C Model [18]: A centralized model is characterized by a central point that forwards messages between clients. The centralized model has some advantages such as simple implementation and customization. However, the centralized C&C model will be detected and destroyed easier 2) P2P-based C&C Model [18]: For drawbacks of centralized model, the Botmaster shifts to P2P-based botnet. Compared with the centralized C&C model, the P2P based C&C model is much harder to discover and destroy. Botmaster can send commands from any peer. However, it is a more complex job for designing p2p systems. 3) Unstructured C&C Model: A bot will not actively contact other bots or the Botmaster, and would listen to incoming connections from its Botmaster. The Botmaster randomly scan the Internet and pass along the encrypt message when it detected another bot.[10] Distributed Systems: A Distributed system is a piece of software that ensures that a collection of independent computers appears as a single coherent system to its users. Famous examples are: (A) An intranet which is a portion of the internet managed by an organisation (B) The internet (C) World Wide Web(WWW) Fig : Distributed Systems Advantages: 1. Economic use of resources: A collection of processors provide higher performance. It is a cost effective way to increase computing power. 2. Higher speed: Enhanced performance through load distribution.