Search

Sybil attack is useful for mitigating P2P botnets, and the effect depends mainly on influence of Sybil nodes. However, how to improve influence of Sybil nodes is still a problem rarely studied. Taking Kademlia based botnets as the research object, we proposed a method to improve influence of Sybil nodes in P2P botnets. We constructed a testing system based on Planetlab and KAD network, and conducted tests through the Internet. Results of our experiments show that this method can obviously enhance the influence of Sybil nodes. For defenders that study how to mitigate P2P botnets, this method may give helpful guidance.

An algorithm named PTBBWD is presented to detect worms. It is process traffic behavior based and has considered three important behaviors: total amount of source ports in wormlike traffic, changing frequency of source ports in wormlike process traffic and the wormlike traffic proportion of the total process traffic. Unlike similar work before, PTBBWD checks the frequency and the total amount of source ports only when a process is sending wormlike traffic. Experiments using applications in the wild show that PTBBWD can detect worms quickly and correctly with small false positives.

In order to improve the communication speed, low-delay anonymous communication systems, such as Tor, prefer high performance router when selecting routers. This choice makes routers' selection being local. This paper first proposes router selecting algorithm based on location diversity and RTT; then a hierarchical location-diversity-based low-delay anonymous communication framework is presented. This framework's security is analyzed and a simulation experiment and result analysis is given. The theoretic analysis and simulation experiment indicate that the HLLACF can prevent AS-Level passive attack and other similar attacks well while decreasing communication delay and HLLACF also scales well.