Abstract
Mobile botnet has recently evolved due to the rapid growth of smartphone technologies. Unlike legacy botnets, mobile devices are characterized by limited power capacity, calculation capabilities, and wide communication methods. As such, the logical topology structure and communication mode have to be redesigned for mobile botnets to narrow energy gap and lower the reduction speed of nodes. In this paper, we try to design a novel Gini-based energy balancing scheme (Gleer) for the atomic network, which is a fundamental component of the heterogeneous multilayer mobile botnet. Firstly, for each operation cycle, we utilize the dynamic energy threshold to categorize atomic network into two groups. Then, the Gini coefficient is introduced to estimate botnet energy gap and to regulate the probability for each node to be picked as a region C&C server. Experimental results indicate that our proposed method can effectively prolong the botnet lifetime and prevent the reduction of network size. Meanwhile, the stealthiness of botnet with Gleer scheme is analyzed from users’ perspective, and results show that the proposed scheme works well in the reduction of user’ detection awareness.
1. Introduction
With the improvement of integrated-circuit technology, smartphones begin to provide better support for applications and services. Since users are increasingly exploiting smartphones for sensitive transactions (especially online shopping and banking), these mobile devices contain more sensitive and privacy information than legacy computer. Their unique features, including mobility, portability, and wide connectivity options, also play a significant role in promoting the rapidly growing popularity of smartphones. However, due to the lack of sufficient security and privacy protection mechanisms, smartphones are inevitably becoming the hot target of hackers. Among these threats from hackers, the mobile botnet [1] (evolved from traditional botnet) is the most destructive one, which not only steals user’s privacy, but also attacks other network devices (e.g., DDOS). The motivation of this work is to shed light on potential botnet threats that are targeting smartphones. Since there are differences between computer and smartphone in many aspects, such as system structure and communication mode, existing techniques against computer botnets may not be applicable to mobile botnets. Thus, in the paper, we propose a Gini-based energy balancing scheme for defending mobile botnet attack, which can promote security researchers to investigate and develop new countermeasures before mobile botnets become a major threat [2].
The botnet life-cycle can be divided into six stages: botnet conception, botnet recruitment, botnet interaction, botnet marketing, attack execution, and attack success [3]. In the first stage, after confirming the motivation for creating a botnet, the following steps are processed for implementing the desired botnet. Various aspects should be carefully considered in this step, especially those regarding bot infection and botnet communications. From botmasters’ perspective, improving the stealthy and robust of mobile botnet becomes the key objective in design process, while understanding the deployment strategy of a mobile botnet is critical for defending against malicious attacks on network in runtime from operators’ perspective. Recently, there exist many literatures focused on mobile botnet communications design. Singh et al. [4] developed a mobile botnet on the basis of node popularity and leveraged publicly available data to demonstrate that the Bluetooth technology can be used as C&C channel in a mobile botnet. Zeng et al. [5] proposed a mobile botnet that makes the most of mobile services and is resilient to disruption, utilizing SMS message for C&C and imitating the P2P fashion in the PC world. It is finally demonstrated that the structured architecture is a best choice for the mobile botnet topology. And in [6], Chen et al. proposed a novel multiple-push service based botnet, which significantly outperforms existing push-styled mobile botnet by exploring the design space of exploiting such services.
In the design process, the botnet architecture is the key decision, which determines the operation of subsequent element and thus the whole body of botnet [7]. The mobile botnet node, i.e., smartphone, constitutes the main component of mobile botnet architecture. The mobile botnet composed of smartphones is similar to sensor networks (SNs) in the architecture. (1) Topology design: their architecture can be centralized, distributed, or hybrid. Since the centralized scheme may encounter a single-point-of-failure, and distributed one is with high communication cost, most works on mobile botnet topology design are based on heterogeneous multilayer [8, 9], similar to cluster division of SNs. (2) Node management: due to the constrained power of smartphone and sensor, designing a node management scheme to reduce the node energy consumption and lowering the atomic network energy gap are in need. However, due to the fact that there exist some differences in constituent nodes and practical significance, the SNs management scheme cannot be applied to mobile botnet directly, such as low-energy adaptive clustering hierarchy (LEACH) and stable election protocol (SEP).
In view of the mobile botnet features and differences mentioned above, in this paper, we propose a region command and conquer (C&C) server selection scheme. At each start of operation cycle, we firstly divide smartphones of an atomic network into two categories according to their remaining capacity by the dynamic energy partitioning threshold. Then, the Gini coefficient is introduced to evaluate the power gap of nodes in the atomic network. Finally, the above coefficient values are leveraged to adjust and assign the selection probability to each type. Experimental results indicate that our proposed scheme can narrow the power gap of nodes in the atomic network and lower the reduction rate of network scale simultaneously. Meanwhile, the diversity of mobile network energy distribution at each experimental stage can lower the awareness of users effectively, which is beneficial to the concealment of mobile botnet. Therefore, the defensive strategies, which target the mobile botnet designed based on Gleer, should consider comprehensive factors instead of single factor like node power and use machine learning to explore potential insecurity features to detect the mobile botnet.
The rest of the paper is organized as follows: Section 2 describes the current researches on the mobile botnet topology and some cluster-head selection schemes for SNs; Section 3 shows the proposed C&C server selection scheme; Section 4 shows the experiment and result analysis; Section 5 presents the overall conclusions of this paper.
2. Related Work
2.1. Mobile Botnet Model
Different from legacy botnets, mobile botnets have to address new challenges from the unique features of mobile Internet and smartphones. More precisely, smartphones typically are with limited battery power, computation, and communication capabilities. If a bot consumes too much power, network traffic, or computation resource, then it will cause owner’s awareness immediately. Many researches solve this problem by allocating hardware resources. For example, Chen et al. [10] proposed a novel cloud-based technology to overcome existing issues of mobile botnets. Meanwhile, due to the similarity between mobile botnets and SNs, we can also derive the network topology management scheme in SNs as follows. (1) The limited energy: despite being battery-operated, it may be unrealistic to recharge them due to either the inhospitable terrain for sensors or the high-mobility for smartphones. As such, the network lifetime maximization is of prime importance for SNs and mobile botnets [11]. (2) Cooperation [12]: they both involve a large number of nodes. Despite constrained capability of single node due to its limited energy capacity and communication capabilities, the collaboration among hundreds of nodes could offer unlimited possibilities. (3) High confidentiality: as SNs have been widely used in military, industrial, and health-care applications, the data transmitted among sensors are typically with significant values similar to the delivery in the mobile botnet for botnet controller. Thus, a secure communication with high confidentiality is perquisite [13].
It follows that SNs and mobile botnets share common goals: lifetime prolonging, coverage extension, seamless integration, and high reliability. Since data communication is basically an energy-intensive activity, the distribution of communication load among sensors contributes to their energy-consuming equilibration [14]. Currently, there are many existing works [15–19] with respect to clustering nodes to balance energy depletion and extending network lifetime further. Typically, nodes are divided into groups, and then a specific one is selected as the CH, similar to the hybrid scheme in the mobile botnet. In [20], a typical structure is designed, showed as in Figure 1, where the multilayer heterogeneous mode is favored, and the basic composition is atomic network which likes cluster in sensors. In Figure 1, the botmaster generates and sends commands to C&C servers, which distributes received commands to some region C&C servers further. Next, by analyzing each command, the region C&C server controls some bots to execute it, i.e., with a similar functionality to the cluster head (CH) in SNs.
2.2. Cluster-Head Selection Scheme
In the clustering procedure, selecting a CH for each cluster is of vital significance. Since CHs are responsible for aggregating reports from cluster members and then forwarding collected messages to the sink, they would consume more energy than non-CH nodes. For network retopology, the CH selection is always designed to be dynamic; e.g., LEACH [15] switches the CH role among nodes based on a prior optimal probability. Moreover, HEED [17] selects CH according to a hybrid of node residual energy and a secondary parameter, such as the distance between nodes or node degree. Furthermore, SEP [16] and P-SEP [18] are heterogeneity-aware protocols, introducing a fixed value to represent the initial energy capacity difference ratio between two levels of deployed nodes.
To balance energy consumption, a cluster-head periodicity is favored in the atomic network. The selection used in SNs, nevertheless, does adapt to mobile botnet, with main factors as follows. (1) Mobile botnets need high stealthiness. The abnormal can be more easily awarded by a smartphone than a sensor; e.g., smartphone users are more sensitive to energy consumption. Thus, a fixed ratio (introduced in LEACH) between the remaining capacity and node selection probability cannot be applied to mobile botnets directly. Due to the difference between initial energy of nodes, a fixed value introduced in SEP does not fit the mobile botnet scene. (2) Traditional CH selection schemes do not consider network energy gap, which may increase the network reduction rate. (3) There exist differences in component nodes and practical significance, so the selection scheme should necessitate a combination of their feathers. In view of these factors, we propose an energy balancing CH selection scheme based on Gini coefficient (Gleer). In particular, the energy partitioning threshold, i.e., -value, is introduced, to categorize nodes of an atomic network into two groups: energy-sufficient node and energy-deficient node. Then, Gini coefficient is leveraged as an indicator to estimate botnet energy gap, as well as adjusting and optimizing the selection probability for each type.
3. The Model
3.1. Gini Coefficient for Cluster-Head Selection
Gini coefficient was proposed by famous Italian economist C. Gini on the basis of the Lorenz curve in 1912 and has been deemed as a comprehensive index prevailing in the world showing the inequality degree of income distribution [21]. In this paper, it has been used as the main indicator widely. Figure 2 shows the Gini coefficient intuitively referring to the proportion of area A divided by A + B. In our work, we regard each node in an atomic network as a resident and its surplus energy as the current resident income and introduce the Gini coefficient as the measurement index for energy difference degree. As such, Figure 2 can be explained as follows: A is the area surrounded by actual Lorenz curve and energy absolute no difference curve, and A + B is the surrounded area by absolute no difference curve and absolute difference curve. Here, the Lorenz curve qualitatively reflects the energy difference degree roughly.
The calculation of Gini mean deviation was given as follows:where is the Gini mean deviation; is an absolute value of any pair of income sample deviation; is the sample size; and is the average income. Since is obviously a monotone increasing function of income inequality, Gini stipulatedas a measure of income inequality. According to (1) and (2), we can have
Equation (3) offers a direct calculation method for Gini coefficient valued between 0 and 1, and the smaller, the more fair and the bigger the more unfair. Since this formula just involves the arithmetic operation of income data, this estimation method can be used unconditionally in theory without errors [22, 23]. Based on the Lorenz curve and the calculation method, a simple formula was put forward by Jianhua [24] as follows:
From the above calculation, it follows that nodes are permuted from small to large according to their remaining energy, and denotes the proportion of the accumulated energy of the first node to node in all the nodes resources.
3.2. Proposed Scheme
3.2.1. Energy Partitioning Threshold
Considering the numerical diversity of smartphone residual capacity, we introduce an energy partitioning threshold and divide nodes of an atomic network into two types, namely, energy-sufficient node and energy-deficient node, based on the comparison between and the remaining energy of each node. To ensure that all nodes exhaust at approximately the same time, the nodes with more energy should be CHs more often than those with less energy, so the -value should be set greater than energy mean. Suppose that represents the number of smartphones with nonzero power. The remaining power of node is , , and the value of partition coefficient , decides the range of from the average to maximum energy of nodes; namely,
3.2.2. Classification and Statistics
Formula (6) is utilized to classify each node: represents the remaining energy of node which is larger than ; otherwise, the value is smaller than . Table 1 shows the total number and energy for each node category.
3.2.3. Regulating CH Selection Probability
Sort nodes based on their residual energy in ascending order and calculate Gini coefficient (-value) of the current mobile botnet energy situation by Formula (4). According to the provisions of the relevant organization of United Nations [25], the Gini coefficient below 0.2 denotes the income absolute average; 0.2 to 0.3 denotes relative average; 0.3 to 0.4 denotes relatively reasonable; 0.4 to 0.5 denotes the income inequality relatively large; more than 0.5 denotes a huge income gap. Theoretically, there is a warning threshold, which is upper-bounded by 0.4 empirically; beyond 0.4, the society would be not in harmony, such as regional unbalance, rural and remote poverty, discrimination, hostility, crime, and environmental degradation [26, 27]. Since the surplus energy of each node is regarded as resident income, to balance node energy consumption and lower network size reduction rate, we use as the dividing line to regulate the cluster-head selection probability following Table 2, where and , respectively, represent the total selection probability for each category.
3.2.4. Calculating the Selection Probability for Each Node
To prevent the defender from detecting botnet and hide the nodes selection rule, the selection probability is identical between nodes of the same kind. The actual selection probability for each category is, respectively, represented by , .
4. Model Analysis
In [28], Tremblay et al. presented an easy-to-use battery model applicable to dynamic simulation. Figure 3 shows one of the typical lithium battery consumption curves for smartphones. Due to the similarity of smartphone users belonging to the same time zone, for example, most users are accustomed to charging smartphones fully at night and terminating charging between 6:30 and 8:00 a.m., therefore, if phones are approximately homogeneous, then they have almost the same capacity of lithium battery, application software, and usage habits. We can thus infer that the battery consumption curve of their smartphones is almost the same. Then, the remaining power of a smartphone at a certain time follows normal distribution. To analyze the performance of Gleer directly, we conduct experiments in MATLAB testbed and expand the experiment to atomic network with -value larger than 0.4. The initial node number is represented by .
(1) Since CH nodes consume much more energy than normal ones, the atomic network should perform the CH selection process periodically to prevent the reduction of botnet size. Figure 4 shows the variation of Gini coefficient throughout the botnet lifetime. From Figure 4, it reveals that LEACH shows a significant increase, while Gleer is nearly stable. Meanwhile, it is obvious that Gleer outperforms LEACH in terms of lowering energy gap. That is, the proposed scheme could benefit the energy balance distribution of mobile botnet.
(a) Initial energy -value = 0.4396
(b) Initial energy -value = 0.4133
(2) Figure 5 represents the -value versus the partition coefficient (). As Figure 5(a) shows, when the initial sample and experiment conditions are identical, the energy distribution (-value) almost remains unchanged with partition coefficient (-value). Since -value is an important parameter of Gleer scheme, the diversity of mobile botnet can prevent defenders cracking its internal rules and benefit the stealthiness of mobile botnet. Figure 5(b) also reveals the relationships between different initial conditions. From Figures 5(a) and 5(b), it follows that there exists a certain range for the multiexperiments with the same sample. However, boundaries emerge with different initial samples.
(a) Four experiments of the same sample
(b) Four experiments with different sample
5. Simulation
NS-3 is an open-source and widely used network simulation platform [29] for networking research; it contains many models which simulate the packet data networks working and performing scene and provides a simulation engine for users to conduct simulation experiments. In this section, NS-3 platform is used to validate our model.
For simplicity, we only consider one cell as an atomic network with multiple nodes, and the base station is responsible for the connections between these nodes and the C&C server. Based on the models in [30] provided by NS-3, we build the network topology as shown in Figure 6. The battery model parameter for each node is from [28, 31], and Table 3 shows the detailed simulation configuration. The main task of this simulation is to select a node in the cell to be the region C&C server.
(1) Figure 7 shows mobile botnet performance in terms of energy node survival rate, energy consumption ratio, energy consumption ratio differences, and energy consumption ratio differences cumulative sum. With identical initialization (i.e., , -value = 0.473), it can be observed from Figure 7(a) that the mobile botnet with Gleer scheme has larger lifetime than that with LEACH scheme. Since the proposed scheme involves the botnet energy distribution, it could benefit the prevention of botnet scale reduction caused by improper node selection. Figures 7(b), 7(c), and 7(d) show the energy consumption comparison; since Gleer contributes to the maintenance of botnet size and the lowering of number of death nodes, it can save much more energy and execute much more attacks with limited energy resources.
(a)
(b)
(c)
(d)
(2) For some abnormal cases, for example, strange SMS with a website URL linked to virus and emails with an attachment cheating, the intuition for smartphones users to judge whether a cell phone is safe is to observe the battery power variation. In order to show users’ view obviously, the simulation is conducted six times with the same initial user group (, -value = 0.437) and -value (), and six users are picked randomly to observe their energy consumption. As Figure 8 shows, when the simulation reaches 30 s, there exists an energy bound for No. 4 user, ranging from J and J. For No. 25 user, the energy of six simulations is almost the same. And for No. 5 user, the time of arriving at the lowest energy varies. From these simulation results, it is observed that one user (infected by the mobile botnet with the proposed scheme) cannot judge whether his smartphone is abnormal or not, by analyzing the energy consumption. The energy consumption diversity across users shows that our proposed scheme can improve the stealthiness of mobile botnet effectively.
6. Defensive Strategies
As described in [32], smartphones not only provide capabilities of legacy computers, but also offer a large number of connectivity options, i.e., IEEE 802.11, Bluetooth, and GPRS. In addition, smartphones have stronger personalization. Thus, detection methods, such as traffic detection [33, 34], with good effects to computer world may not be applicable to mobile botnet. Different from computers, smartphones are characterized by limited resources, e.g., CPU and memory. Among these characteristics, the battery is predominant for users to discover the abnormal of their smartphones.
In Gleer, node energy consumption is closely related to botnet structure and energy distribution, which significantly lowers the probability that defenders can observe or disrupt networks. For one node, the probability to be CH is related to the botnet energy gap and division line, rather than its remaining energy. Legacy detection methods, such as power consumption [35] and application signature analysis [36], are unlikely to help protect cellular providers against such activity. Therefore, based on the characteristics of Gleer, exploring features with a combination of unsupervised (clustering) and supervised (classification) machine learning is more appropriate, e.g., the feature extraction from battery usage statistics and attack model. The main steps can be summed up as collecting enough data, analyzing their intrinsic characteristics, adjusting learning algorithms, and finding their internal relations further.
7. Conclusion and Future Work
In this paper, we proposed a new CH selection scheme (Gleer) for heterogeneous multilayer mobile botnet. We first utilized the dynamic energy partitioning threshold to categorize atomic network nodes into two groups. Then, we introduced the Gini coefficient to estimate the current power gap of nodes and regularized the probability of becoming the region C&C server for each kind node based on the above gap coefficient value. The experimental results show that the proposed scheme works well in narrowing the gap than traditional ones. In order to confirm our results more accurately, we compared Gleer and LEACH in the NS-3 network simulation platform, and the results demonstrate that the mobile botnet with the proposed scheme has longer lifetime and save more energy; that is, the botmaster can execute more attacks with limited energy resources. Meanwhile, we also analyzed the diversity of network energy distribution with different conditions and show the energy consumption variation in users’ perspective. And results show that the proposed scheme can maintain the performance diversity of the botnet energy distribution, which benefits the concealment of the mobile botnet.
Data Availability
The data used to support the findings of this study are available from the corresponding author upon request.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This paper is supported by the National Natural Science Foundation of China (61602376, U1334211, U1534208, 61602374, and 61702411), Natural Science Foundation of Shanxi Province (2017JQ6020), Science Technology Project of Shaanxi Education Department (16JK1573), Ph.D. Research Startup Funds of Xi’an University of Technology (112-256081504), College Research Funds of Xi’an University of Technology (112-451016007), National Foundation of China (U1534208), and Science and Technology Innovation Project of Shanxi Province (2015KTZDGY0104).