Content

assets/sensorbuster/sensor_with_outgoing.drawio

@@ -0,0 +1 @@
+<mxfile host="app.diagrams.net" modified="2022-04-18T12:30:38.803Z" agent="5.0 (X11)" etag="FB4uTwF8qo5FTpZHxZjJ" version="17.4.5" type="device"><diagram id="LFcAgUIaCAVE67g-DHpV" name="Page-1">7ZrLjpswFIafJstIYEOAZZO5tFKrVora6dYCT2BEcGScy/Tp6xSTBJtMGAbIidRNBAew8e/P9u9DRni23D1ysoq/sYimI2RFuxG+GyHkT3z5uw+8FgHHd4rAgidREbKPgXnyh6qgpaLrJKJ55UbBWCqSVTUYsiyjoajECOdsW73tmaXVWldkQY3APCSpGX1KIhGrZrnWMf6ZJou4rNm21JUlKW9WgTwmEduehPD9CM84Y6I4Wu5mNN1rV+pSPPdw5urhxTjNRJMHxNPYmaIX8oXgOVq+5Lv4Zz5GRSkbkq6rDc7FaymBLEaqLU+m2zgRdL4i4f7KVva3jMVimcozWx6SfFV0wXOyo7LW6TPLhOpS+XJ4ar6yqm1DuaC7k5BqwiNlSyr4q7ylvDpRciqeUKn39qR3VCg+6ZgyRhQPi0PJR8nkgVLtHQpiQ0EftoLIqSqI0ZUVdAwFPdgKYo1B59oMuoaCCLaCOoP+lQWcGAK6sAV0oU2DnqHgBLaCjg9sGvQNBZ3bUvDagzgwBMSwBTysI9dSzLYNyUzFsujT3kfLszAleZ6EVaE4W2fRXqE76z0q5WzNQ3rZmQrCF1RcXvtoVPHxpuYnGrs1GpcxTlMikk3VDNcJr2r4wRLZsuOYsLR5We+7ot3qqVO3rhWke4zDilkWVAhjFPSPg0OzP4CGuTMAg4bbEI0AFhq21qNBV2hYA6NhbnnAoBE0RMOHhQbSvIjeo03RMKafodEw93Jg0PBvc0HBGhp2WzScK6NhblLBoDG5TTTOJXI+jMbQXsPcfoNBo6kNxbDQcDU0cFdeQ/ezfaNh5hXAoOE0RAOY19B6FOuDvbXXGBoNM2ECBg3vNmcNT0PD7WpBGRoNMxUEBo2ms4YHC41AQ8Nru6DoflYvqGc0So8EEQ3cEA0HFBqutg7g1ikv3c/2N2sk0Wz84EdsOv4aWJtf8++/nfuxmQyd0yxn3OSj4ySykTGuwafxx8ghvwTVyoiGGWAa/Z25+/No3HxOWd8VIH1X0PMAGyhv2AkZNSkBeGQgvUPbGjbsXSioZzIGSht2QkbN1weAZOirwqQtGf6FgnomY6CsYSdk1Oz6AJKhD/XWTj64UFDPZAyUNOyEjJpNH0Ay9KHe2mcMlxmqVXGgnOF7yXhr09HsW/Z/B3qWDHl6/Ct1cfvx/+j4/i8=</diagram></mxfile>

assets/sensorbuster/sensor_without_outgoing.drawio

@@ -0,0 +1 @@
+<mxfile host="app.diagrams.net" modified="2022-04-18T12:28:53.141Z" agent="5.0 (X11)" etag="qXE_Socbwdi35VUjIE3T" version="17.4.5" type="device"><diagram id="LFcAgUIaCAVE67g-DHpV" name="Page-1">1ZrbjpswEIafJpeRiA0BLpvsqVKrVora7a0F3sCK4Aicw/bp6xSThDGrsCyQyU0EA4zxP5/t8ZARna/2jxlbR99FyJMRscL9iN6NCPGmnvo9GN4Kg+3ZhWGZxWFhmpwMi/gv10ZLWzdxyPPKjVKIRMbrqjEQacoDWbGxLBO76m0vIqm2umZLbhgWAUtM63Mcykh3y7FO9iceL6Oy5Ymlr6xYebM25BELxe7MRO9HdJ4JIYuj1X7Ok4N2pS7Fcw/vXD2+WMZT2eQB+Ty2Z+SVfWV0QVav+T76lY9J4WXLkk21w7l8KyVQbpTa6mS2i2LJF2sWHK7sVLyVLZKrRJ1N1CHL10UIXuI9V63OXkQqdUjVy9GZ+cq6tS3PJN+fmXQXHrlYcZm9qVvKq1Mtp+aJlHrvzqKjTdFZYEob0zwsj55PkqkDrdoHFKSGgh5uBYldVZCSKytoGwq6uBWkgEH72gw6hoIEt4KQQe/KAk4NAR3cAjrYpkHXUHCKW0HbQzYNeoaC9m0peO1B7BsCUtwCHteRayk2mRiSmYql4ZdDHq3OgoTleRxUhcrEJg0PCt1ZH1EpF5ss4JczU8myJZeX1z4eVvJ4U/MzjZ0ajUtbxhMm4201Ga4TXrfwU8SqZ6cxYYF5Gcau6Ld+6jxbB45gjnFcMUtHhTCGo/8cHLv9CTTMnQEaNJyGaPi40JiAiPpdoWENjIa55UGDht8QDQ8XGgTkIjCiTdEwpp+h0TD3cmjQ8G5zQaEAjUlbNOwro2FuUtGgMb1NNN4r5HwajaFzDXP7jQaNpmkoxYWGA9CgXeUaMJ/tGw2zroAGDbshGshyDRBRCgd761xjaDTMggkaNNzbnDVcgIbT1YIyNBpmKQgNGk1nDRcXGj5Aw227oMB8FjrqGY0yR8KIBm2Iho0KDQesA7R1yQvms/3NGnE4Hz94oZiNv/nW9vfixx/7fmwWQxc8zUVm8tFxEdmoGNfg0/hj5JBfgmplJMMMMEB/Z9n9+2jcfE0Z7goI3BX0PMAGqht2QkZNSQAfGQQGtG3CRt0LjnomY6CyYSdk1Hx9QEgGXBWmbcnwLjjqmYyBqoadkFGz60NIBhzqrTN5/4KjnskYqGjYCRk1mz6EZMCh3jrP6K0ypE5Pf5gtbj/965je/wM=</diagram></mxfile>

content.tex

@@ -605,7 +605,6 @@ The following candidates to place on the neighbor list will be investigated:
 
 Returning all the other sensors when responding to peer list requests, thereby effectively creating a complete graph \(K_\abs{C}\) among the workers, creates valid outgoing edges.
 The resulting graph will still form a \ac{wcc} with now edges back into the main network.
-Also, this would leak the information about all known sensors to the botmasters.
 
 %{{{ churned peers
 \subsubsection{Churned Peers After IP Rotation}
@@ -634,7 +633,7 @@ Those peers can be used as fake neighbors and create valid-looking outgoing edge
 \clearpage{}
 \section{Evaluation}
 
-To evaluate the strategies from above, we took a snapshot of the Sality~\cite{bib:falliere_sality_2011} botnet obtained from \ac{bms} throughout of \daterange{2021-04-21}{2021-04-28}.
+To evaluate the strategies from above, we took a snapshot of the Sality~\cite{bib:falliere_sality_2011} botnet obtained from \ac{bms} throughout of \daterange{2021-04-21}{2021-04-28}, if not stated otherwise.
 
 %{{{ eval load balancing
 \subsection{Load Balancing}
@@ -875,21 +874,53 @@ Applying PageRank with an initial rank of \(0.25\) once on the example graphs in
 
 While this works for small networks, the crawlers must account for a significant amount of peers in the network for this change to be noticeable.
 The generated \(K_n\) needs to be at least as big as the smallest regular component in the botnet, which is not feasible.
+Also, if detected, this would leak the information about all known sensors to the botmasters.
+The limited scalability, and potential information leak, which might be used by botmasters to retaliate against the sensors or the whole monitoring operation, make this approach unusable in real-world scenarios.
 
 
 %}}} other sensors
 
+
+\subsubsection{Effectiveness against SensorBuster}
+
+SensorBuster relies on the assumption that sensors don't have any outgoing edges, thereby creating a disconnected graph component.
+
+\begin{figure}[H]
+\centering
+\begin{subfigure}[b]{.5\textwidth}
+  \centering
+  \includegraphics[width=.8\linewidth]{sensorbuster/sensor_without_outgoing.drawio.pdf}
+  \caption{Sensor without outgoing edge creates disconnected graph component}
+\end{subfigure}%
+\begin{subfigure}[b]{.5\textwidth}
+  \centering
+  \includegraphics[width=.8\linewidth]{sensorbuster/sensor_with_outgoing.drawio.pdf}
+  \caption{Single outgoing edge connects sensor back to the main component}\label{fig:sensorbusterWithOutgoing}
+\end{subfigure}%
+\end{figure}
+
+\Fref{fig:sensorbusterWithOutgoing} shows how a single valid edge  back into the network (from \emph{Sensor} to peer \num{3} in the example) renders the SensorBuster metric ineffective by making the sensor part of the main graph component.
+
+For the \ac{wcc} metric, it is obvious that even a single edge back into the main network is enough to connect the sensor back to the main graph and therefore beat this metric.
+
+\todo{formulieren}
+
+\subsubsection{Effectiveness against Page- and SensorRank}
+
+In this section we will evaluate how adding outgoing edges to a sensor impacts it's PageRank and SensorRank values.
+Before doing so, we will check the impact of the initial rank by calculating it with different initial values and comparing the value distribution of the result.
+
 \begin{table}[H]
   \centering
 \begin{tabular}{lllll}
   \textbf{Iteration} & \textbf{Avg. PR} & \textbf{Crawler PR} & \textbf{Avg. SR} & \textbf{Crawler SR} \\
-  1 & 0.24854932 & 0.63277194 & 0.15393478 & 0.56545578 \\
-  2 & 0.24854932 & 0.63277194 & 0.15393478 & 0.56545578 \\
-  3 & 0.24501068 & 0.46486353 & 0.13810930 & 0.41540997 \\
-  4 & 0.24501068 & 0.46486353 & 0.13810930 & 0.41540997 \\
-  5 & 0.24233737 & 0.50602884 & 0.14101354 & 0.45219598 \\
+  \num{1} & \num{0.24854932} & \num{0.63277194} & \num{0.15393478} & \num{0.56545578} \\
+  \num{2} & \num{0.24854932} & \num{0.63277194} & \num{0.15393478} & \num{0.56545578} \\
+  \num{3} & \num{0.24501068} & \num{0.46486353} & \num{0.13810930} & \num{0.41540997} \\
+  \num{4} & \num{0.24501068} & \num{0.46486353} & \num{0.13810930} & \num{0.41540997} \\
+  \num{5} & \num{0.24233737} & \num{0.50602884} & \num{0.14101354} & \num{0.45219598} \\
 \end{tabular}
-  \caption{Values for PageRank iterations with initial rank \(\forall v \in V : \text{PR}(v) = 0.25\)}\label{tab:pr_iter_table_25}
+  \caption{Values for PageRank iterations with initial rank \(\forall v \in V : \text{PR}_0(v) = 0.25\)}\label{tab:pr_iter_table_25}
 \end{table}
 
 \begin{figure}[H]
@@ -904,20 +935,20 @@ The generated \(K_n\) needs to be at least as big as the smallest regular compon
   \includegraphics[width=1\linewidth]{0.25_5_sr.png}
   \caption{Distribution after 5 iterations}\label{fig:dist_sr_25_5}
 \end{subfigure}%
-  \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.25\)}\label{fig:dist_sr_25}
+  \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}_0(v) = 0.25\)}\label{fig:dist_sr_25}
 \end{figure}
 
 \begin{table}[H]
   \centering
 \begin{tabular}{lllll}
   \textbf{Iteration} & \textbf{Avg. PR} & \textbf{Crawler PR} & \textbf{Avg. SR} & \textbf{Crawler SR} \\
-  1 & 0.49709865 & 1.26554389 & 0.30786955 & 1.13091156 \\
-  2 & 0.49709865 & 1.26554389 & 0.30786955 & 1.13091156 \\
-  3 & 0.49002136 & 0.92972707 & 0.27621861 & 0.83081993 \\
-  4 & 0.49002136 & 0.92972707 & 0.27621861 & 0.83081993 \\
-  5 & 0.48467474 & 1.01205767 & 0.28202708 & 0.90439196 \\
+  \num{1} & \num{0.49709865} & \num{1.26554389} & \num{0.30786955} & \num{1.13091156} \\
+  \num{2} & \num{0.49709865} & \num{1.26554389} & \num{0.30786955} & \num{1.13091156} \\
+  \num{3} & \num{0.49002136} & \num{0.92972707} & \num{0.27621861} & \num{0.83081993} \\
+  \num{4} & \num{0.49002136} & \num{0.92972707} & \num{0.27621861} & \num{0.83081993} \\
+  \num{5} & \num{0.48467474} & \num{1.01205767} & \num{0.28202708} & \num{0.90439196} \\
 \end{tabular}
-  \caption{Values for PageRank iterations with initial rank \(\forall v \in V : \text{PR}(v) = 0.5\)}\label{tab:pr_iter_table_5}
+  \caption{Values for PageRank iterations with initial rank \(\forall v \in V : \text{PR}_0(v) = 0.5\)}\label{tab:pr_iter_table_5}
 \end{table}
 
 \begin{figure}[H]
@@ -932,20 +963,20 @@ The generated \(K_n\) needs to be at least as big as the smallest regular compon
   \includegraphics[width=1\linewidth]{0.50_5_sr.png}
   \caption{Distribution after 5 iterations}\label{fig:dist_sr_50_5}
 \end{subfigure}%
-  \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.5\)}\label{fig:dist_sr_50}
+  \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}_0(v) = 0.5\)}\label{fig:dist_sr_50}
 \end{figure}
 
 \begin{table}[H]
   \centering
 \begin{tabular}{lllll}
   \textbf{Iteration} & \textbf{Avg. PR} & \textbf{Crawler PR} & \textbf{Avg. SR} & \textbf{Crawler SR} \\
-  1 & 0.74564797 & 1.89831583 & 0.46180433 & 1.69636734 \\
-  2 & 0.74564797 & 1.89831583 & 0.46180433 & 1.69636734 \\
-  3 & 0.73503203 & 1.39459060 & 0.41432791 & 1.24622990 \\
-  4 & 0.73503203 & 1.39459060 & 0.41432791 & 1.24622990 \\
-  5 & 0.72701212 & 1.51808651 & 0.42304062 & 1.35658794 \\
+  \num{1} & \num{0.74564797} & \num{1.89831583} & \num{0.46180433} & \num{1.69636734} \\
+  \num{2} & \num{0.74564797} & \num{1.89831583} & \num{0.46180433} & \num{1.69636734} \\
+  \num{3} & \num{0.73503203} & \num{1.39459060} & \num{0.41432791} & \num{1.24622990} \\
+  \num{4} & \num{0.73503203} & \num{1.39459060} & \num{0.41432791} & \num{1.24622990} \\
+  \num{5} & \num{0.72701212} & \num{1.51808651} & \num{0.42304062} & \num{1.35658794} \\
 \end{tabular}
-  \caption{Values for PageRank iterations with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{tab:pr_iter_table_75}
+  \caption{Values for PageRank iterations with initial rank \(\forall v \in V : \text{PR}_0(v) = 0.75\)}\label{tab:pr_iter_table_75}
 \end{table}
 
 \begin{figure}[H]
@@ -960,26 +991,27 @@ The generated \(K_n\) needs to be at least as big as the smallest regular compon
   \includegraphics[width=1\linewidth]{0.75_5_sr.png}
   \caption{Distribution after 5 iterations}\label{fig:dist_sr_75_5}
 \end{subfigure}%
-  \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}(v) = 0.75\)}\label{fig:dist_sr_75}
+  \caption{SensorRank distribution with initial rank \(\forall v \in V : \text{PR}_0(v) = 0.75\)}\label{fig:dist_sr_75}
 \end{figure}
 
-The distribution graphs in \Fref{fig:dist_sr_25}, \Fref{fig:dist_sr_50} and \Fref{fig:dist_sr_75} show that the initial rank has no effect on the distribution, only on the actual numeric rank values.
+The distribution graphs in \Fref{fig:dist_sr_25}, \Fref{fig:dist_sr_50} and \Fref{fig:dist_sr_75} show that the initial rank has no effect on the distribution, only on the actual numeric rank values and how far apart they are spread.
 
-For all combinations of initial value and PageRank iterations, the rank for a well-known crawler is in the \nth{95} percentile, so for our use case, those parameters do not matter.
+For all combinations of initial value and PageRank iterations, the rank for a well-known crawler is in the \nth{95} percentile, so for our use case---detecting sensors due their high ranks---those parameters do not matter.
 
-On average, peers in the analyzed dataset have \num{223} successors over the whole week.
-Looking at the data in smaller buckets of one hour each, the average number of successors per peer is \num{90}.\todo{timeline with peers per bucket}
+% On average, peers in the analyzed dataset have \num{223} successors over the whole week.
+Looking at the data in smaller buckets of one hour each, the average number of successors per peer is \num{90}.
 
 %{{{ fig:avg_out_edges
-\begin{figure}[h]
+\begin{figure}[H]
 \centering
 \includegraphics[width=1\linewidth]{./avg_out_edges.png}
 \caption{Average outgoing edges per peer per hour}\label{fig:avg_out_edges}
 \end{figure}
-\todo{use better data?}
 %}}}fig:avg_out_edges
 
-Experiments were performed, in which a percentage of random outgoing edges were added to the known sensor, based on the amount of incoming edges:
+% Experiments were performed, in which a percentage of random outgoing edges were added to the known sensor, based on the amount of incoming edges:
+We evaluate the impact of outgoing edges by picking a percentage of random nodes in each bucket and creating edges from the sensor to each of the sampled peers, thereby evening the ratio between \(\deg^{+}\) and \(\deg^{-}\).
+
 
 \begin{figure}[H]
   \centering
@@ -1030,7 +1062,6 @@ Experiments were performed, in which a percentage of random outgoing edges were
 \end{figure}
 
 These results show, that simply adding new edges is not enough and we need to limit the incoming edges to improve the Page- and SensorRank metrics.
-For the \ac{wcc} metric, it is obvious that even a single edge back into the main network is enough to connect the sensor back to the main graph and therefore beat this metric.
 
 %}}} eval creating edges
 

report.tex

@@ -68,6 +68,7 @@ headsepline,
 \sisetup{%
    group-separator={,},
    group-minimum-digits=5,
+   group-digits=integer,
    range-phrase={\text{\ensuremath{-}}},
    per-mode = fraction,
    fraction-function=\nicefrac,