4th International ICST Conference on Security and Privacy in Communication Networks

Research Article

Overbot - A botnet protocol based on Kademlia

  • @INPROCEEDINGS{10.1145/1460877.1460894,
        author={Guenther Starnberger and Christopher Kruegel and Engin Kirda},
        title={Overbot - A botnet protocol based on Kademlia},
        proceedings={4th International ICST Conference on Security and Privacy in Communication Networks},
        keywords={Botnet Protocol Malware Network Security},
  • Guenther Starnberger
    Christopher Kruegel
    Engin Kirda
    Year: 2008
    Overbot - A botnet protocol based on Kademlia
    DOI: 10.1145/1460877.1460894
Guenther Starnberger1,*, Christopher Kruegel2,*, Engin Kirda3,*
  • 1: Distributed Systems Group Vienna Univ. of Technology
  • 2: UC Santa Barbara
  • 3: Eurecom
*Contact email: gst@infosys.tuwien.ac.at, chris@cs.ucsb.edu, kirda@eurecom.fr


One crucial point in the implementation of botnets is the command and control channel, which is used by botmasters to distribute commands to compromised machines and to obtain results from previous commands. While the first botnets were mainly controlled by central IRC servers, recent developments have shown the advantages of a more decentralized approach using peer-to-peer (P2P) networks. Interestingly, even though some botnets already use P2P networks, they do so in a naive fashion. As a result, most existing botnet implementations allow attackers to disrupt messages from the botmaster and to learn IP addresses of other nodes within the botnet. This paper introduces Overbot, a botnet communication protocol based on a peer-to-peer architecture. More precisely, Overbot leverages Kademlia, an existing P2P protocol, to implement a stealth command and control channel. An attacker can neither learn the IP addresses of other nodes in the botnet nor disrupt the message exchange between the botmaster and the bots, even when the attacker is able to capture some of the nodes within the network. Overbot demonstrates the threats that may result when future botnet generations utilize more advanced communication structures. We believe that it is important to outline these threats to allow the research community to develop solutions before such botnets appear in the wild. To help the search for effective countermeasures, we also discuss possible directions where future research seems promising.