DUSTBot: A duplex and stealthy P2P-based botnet in the Bitcoin network.

Area of Science:

• Cybersecurity
• Network Security
• Distributed Systems

Background:

• Botnets are a primary driver of illegal cyber activities and are continuously evolving.
• Existing blockchain-based botnet command and control (C&C) mechanisms face challenges including high costs, single points of failure, and limited scalability.

Purpose of the Study:

• To introduce DUSTBot, a novel peer-to-peer (P2P) botnet model designed to address new cyber threats.
• To present a covert, duplex, and low-cost C&C channel utilizing the Bitcoin network.

Main Methods:

• DUSTBot employs the Bitcoin main network for downstream C&C and the Bitcoin testnet for upstream communication.
• A peer list exchange algorithm leveraging Ethereum block hashes is proposed to counter routing table poisoning and P2P botnet crawling.
• The botnet's robustness against node removal was assessed using a P2P simulator, and its feasibility and performance were evaluated through cloud deployments.

Main Results:

• The study demonstrates the feasibility, performance, stealthiness, and robustness of the DUSTBot model.
• The proposed peer list exchange algorithm proved effective against common P2P botnet attacks.
• DUSTBot exhibits significant stealthiness and resilience in simulated and real-world deployments.

Conclusions:

• DUSTBot presents a viable and effective P2P botnet model leveraging Bitcoin transactions for covert C&C.
• The research highlights the potential for novel cyber threats and the need for developing advanced countermeasures.
• Future work should focus on exploring potential mitigation strategies against such sophisticated botnet architectures.