Decentralized Peer-to-Peer Botnet Architectures

Botnets have historically used centralized architectures for their command and control systems.While deployment and logical construction of these systems is simplistic and efficient, a critical weak-point exists in the central server used to coordinate messages and route traffic. Recently, the introduction of decentralized architectures with peer-to-peer (P2P) routing has provided malware authors with increased resilience and location obfuscation for command distribution points. To date, botnets with these topologies have been difficult for the defenders to accurately enumerate and effectively remediate. In this chapter, we describe the architectures, capabilities, functional behaviors, and current mitigation efforts for the Nugache, Storm, and Mayday botnets.