The most important issue for a Bot is to conceal its commander source so that the analyzer could not find the commander if the Bot is under analysis. In this paper we propose a mechanism for managing the Botnet C&C communication based on Cloud Computing infrastructures. The proposed mechanism provides a hierarchical organization of managerial nodes while all of these nodes are deployed on current Cloud providers. The main goal of this paper is to introduce the new threats that can be utilized by malware developers as a persistence mechanism. To evaluate our work, we have, semi-formally, analyzed four features (Stealthy, Effectiveness, Efficiency, and Robustness) of the mechanism and show that in most of the times the C&C can remain anonymous. Since, knowing the future threads is the best way to prepare for, and then the paper represents the possible countermeasures against the proposed mechanism.
展开▼
