Update

appendix.tex

@@ -1,7 +1,7 @@
 \appendix
 
 % TODO: add to table of contents?
-\printbibliography
+\printbibliography{}
 
 \clearpage
 
@@ -11,10 +11,10 @@
 \clearpage
 
 % TODO: add to table of contents?
-\printacronyms
+\printacronyms{}
 
 \clearpage
 
-\makedeclaration
+\makedeclaration{}
 
 % vim: set filetype=tex ts=2 sw=2 tw=0 et :

archived.dbx

@@ -0,0 +1,6 @@
+\DeclareDatamodelFields[type=field, datatype=uri]{archiveurl}
+\DeclareDatamodelEntryfields{archiveurl}
+\DeclareDatamodelFields[type=field, datatype=date, skipout]{
+  archivedate,
+}
+\DeclareDatamodelEntryfields{archivedate}

content.tex

@@ -1,42 +1,21 @@
-
-% \section{Testeroo ma man}
-
-% \OfficialLogoNormal
-
-% \logoNormal
-
-% \textcolor{Accent}{foo lol fakultätsfarben}
-
-% jo moin~\cite[121]{bib:persistentstruct}
-
-% \Ac{html}
-
-% \ac{html}
-
-% \enquote{look ma, imma quote}~\ref{fig:some_figure}
-
-% \begin{figure}[h]
-% \OfficialLogoNormal
-% \caption{OTH Logo}
-% \label{fig:some_figure}
-% \end{figure}
-
-% asdft~\footfullcite[pre][post]{bib:persistentstruct}
-
-
-% \textsc{Small Caps test Abschnitt}
-
-% \subsection{Sub 1}
-
-% \subsection{Sub 2}
-
-% \subsubsection{Subsub 1}
-
-% ich bin ein text mit fußnote\footnote{lol ich bin eine fußnote}
-
-
+%{{{ introduction
 \section{Introduction}
 
+The internet has become an irreplaceable part of our day to day lives.
+We are always connected via numerous \enquote{smart} and \ac{iot} devices.
+We use the internet to communicate, shop, handle financial transactions and much more.
+Many personal and professional workflows are so dependent on the internet, that they won't work when being offline.
+
+%{{{ motivation
+\subsection{Motivation}
+
+% TODO: fast consumer internet connections 100 Mbit/s ++
+The number of connected \ac{iot} devices is around 10 billion in 2021 and estimated to be constantly growing over the next years up to 25 billion in 2030~\cite{statista_iot_2020}.
+Many of these devices run on outdated software, don't receive any updates and don't follow general security best practices.
+While in 2016 only 77\% of German households had a broadband connection with a bandwidth of 50 Mbit/s or more, in 2020 it were already 95\% with more than 50 Mbit/s and 59\% with at least 1000 Mbit/s~\cite{statista_broadband_2021}.
+This makes them an attractive target for botmasters since they are easy to infect, always online, behind internet connections that are getting faster and faster, and due to their nature as small devices, often without any direct user interaction, an infection can go unnoticed for a long time.
+In recent years, \ac{iot} botnets have been responsible for some of the biggest \ac{ddos} attacks ever recorded, creating up to 1 Tbit/s of traffic~\cite{ars_ddos_2016}.
+
 
 % TODO: what is a bot? Infected systems. Malware. DGA, beispiele, tree vs graph
 
@@ -46,25 +25,67 @@ These \acp{c2} could use anything from \ac{irc} over \ac{http} to Twitter to com
 The infected systems can be abused for a number of things, \eg{} \ac{ddos} attacks, stealing data from victims, as proxies to hide the attackers identity, send spam emails \dots{}
 
 Analyzing and shutting down a centralized botnet is comparatively easily since every bot knows the IP address, domain name, Twitter handle, \ac{irc} channel \dots{} the \acp{c2} are using.
-% TODO: wort für polizei
-A targeted operation with help from TODO, hosting providers, domain registrars and platform providers could shut down or take over the operation by changing how requests are rooted or simply shutting down the controlling servers/accounts.
+
+A targeted operation with help from law enforcement, hosting providers, domain registrars and platform providers could shut down or take over the operation by changing how requests are rooted or simply shutting down the controlling servers/accounts.
 
 % TODO: too informal?
 A number of botnet operations were shut down like this and as the defenders upped their game, so did attackers --- the idea of \ac{p2p} botnets came up.
 The idea is to build a decentralized network without single points of failure where the \acp{c2} are.
 In a \ac{p2p} botnet, each node in the network knows a number of it's neighbours and connects to those, each of these neighbours has a list of neighbours on his own, and so on.
 
-\subsection{Detection Techniques for \ac{p2p} Botnets}
+This lack of a \ac{spof} makes \ac{p2p} botnets more resilient to take-down attempts since the communication is not stopped and botmasters can easily rejoin the network and send commands.
+
+%}}} motivation
+
+%{{{ detection techniques
+\subsection{Detection Techniques for \Acs*{p2p} Botnets}
+
+There are two distinct methods to map and get an overview of the network topology of a \ac{p2p} botnet:
+
+%{{{ passive detection
+\subsubsection{Passive Detection}
+
+For passive detection, traffic flows are analyzed in large amounts of collected network traffic (\eg{} from \acp{isp}).
+This has some advantages in that it is not possible for botmasters to detect or prevent data collection of that kind but it is not trivial to distinguish valid \ac{p2p} application traffic (\eg{} BitTorrent, Skype, cryptocurrencies, \ldots) from \ac{p2p} bots.
+\citeauthor{zhang_building_2014} propose a system of statistical analysis to solve some of these problems in~\cite{zhang_building_2014}.
+Also getting access to the required datasets might not be possible for everyone.
+
+%}}} passive detection
+
+%{{{ active detection
+\subsubsection{Active Detection}
+
+In this case, a subset of the botnet protocol are reimplemented to place pseudo-bots or sensors in the network, which will only communicate with other nodes but won't accept or execute commands to perform malicious actions.
+The difference in behaviour of these sensors from the reference implementation and conspicuous graph properties (\eg{} high $\deg_{\text{in}}$ vs.\ low $\deg_{\text{out}}$) allows botmasters to detect and block the sensor nodes.
+
+%}}} active detection
+
+%}}} detection techniques
 
 \begin{itemize}
 
   % TODO: BotGrep (in zhang_building_2014)
-  \item Large scale network analysis (hard to differentiate from legitimate \ac{p2p} traffic (\eg{} BitTorrent), hard to get data, knowledge of some known bots required)
+  \item Large scale network analysis (hard to differentiate from legitimate \ac{p2p} traffic (\eg{} BitTorrent), hard to get data, knowledge of some known bots required)~\cite{zhang_building_2014}
 
-  % TODO: BotMiner
+  % TODO: BotMiner (in zhang_building_2014)
   \item Heuristics: Same traffic patterns, same malicious behaviour
 
 \end{itemize}
 
+%{{{ detection criteria
+\subsection{Detection Criteria}
+
+\begin{itemize}
+
+  \item \ac{p2p} online time vs host online time
+
+  \item neighbourhood lists
+
+  \item no/few \ac{dns} lookups; instead direct lookups from routing tables
+
+\end{itemize}
+%}}} detection criteria
+
+%}}} introduction
 
 % vim: set filetype=tex ts=2 sw=2 tw=0 et spell :

metadata.tex

@@ -1,4 +1,4 @@
-\title{Organized Crawling of P2P Botnets}
+\title{Centralized Crawling of P2P Botnets}
 
 \author{Valentin Brandl}
 

report.tex

@@ -28,17 +28,40 @@ headsepline,
 % UTF-8 encoding
 \usepackage[utf8]{inputenc}
 \usepackage[T1]{fontenc}
-\usepackage{lmodern}
+
+% language specific quotes and general recommendations for biblatex
+\usepackage{lmodern,csquotes,xpatch}
 
 % acronyms
 \usepackage{acro}
 \include{acronyms}
 
-% language specific quotes
-\usepackage{csquotes}
-
 % bibliography
-\usepackage[backend=biber]{biblatex}
+\usepackage[datamodel=archived,backend=biber]{biblatex}
+%{{{ archivedat and archivedon for online sources
+\NewBibliographyString{archivedat,archivedon}
+\DefineBibliographyStrings{english}{%
+  archivedat = {archived at},
+  archivedon = {on},
+}
+\DeclareFieldFormat{archiveurl}{\bibstring{archivedat}\space\url{#1}}
+\DeclareFieldFormat{archivedate}{\bibstring{archivedon}\space#1}
+
+\newbibmacro*{archiveurl}{\printfield{archiveurl}}
+\newbibmacro*{archivedate}{\printarchivedate}
+\renewbibmacro*{url+urldate}{%
+  \usebibmacro{url}%
+  \iffieldundef{urlyear}
+    {}
+    {\setunit*{\addspace}%
+     \usebibmacro{urldate}}%
+  \setunit{\addcomma\space}%
+  \usebibmacro{archiveurl}%
+  \iffieldundef{archiveyear}
+    {}
+    {\setunit*{\addspace}%
+     \usebibmacro{archivedate}}}
+%}}} archivedat and archivedon for online sources
 \addbibresource{bibliography.bib}
 
 % OTH specific commands for logos, colors
@@ -60,6 +83,8 @@ headsepline,
 % custom commands
 \include{commands}
 
+\setcounter{tocdepth}{2}
+
 \begin{document}
 
 \maketitle
@@ -70,7 +95,7 @@ headsepline,
 
 \include{content}
 
-\cleardoublepage
+\cleardoublepage{}
 
 \include{appendix}