Source-linked AI summary
Host Attack Graph for Botnet Propagation
Andrei Neagu, Mara-Cristina Sterian, Paul Irofti
TL;DR
Botnets are used for multiple attacks, including network expansion, making propagation a relevant modeling problem. The paper introduces the Host Attack Graph and two propagation strategies, then studies them across network topologies and target-selection approaches. Simulations show the strategies’ effectiveness and report modest improvements over the baseline regardless of topology.
Problem
Botnets support attacks including network expansion, motivating a model for estimating host-compromise probabilities in a network.
Source: §1 · p. 1, §5 · p. 11Method
The paper introduces Host Attack Graph and the SIP model, two propagation strategies, and comparisons across graph topologies, centralities, and baseline strategies.
Source: §1 · p. 2, §5 · p. 11Results
The simulations show the two strategies’ effectiveness and topology impacts; centrality-based selection provides modest improvements over the baseline regardless of topology.
Source: §5 · p. 12Takeaways & Limitations
The authors identify centrality-based selection and alternative measures of propagation success as directions for future study.
Source: §5 · p. 12Centralities are computed once after assumed reconnaissance of the entire topology, which the authors identify as a shortcoming for long-term attacks.
Source: §3.3 · p. 8
Abstract
from arXiv · showhide
Botnets represent the backbone of most modern cybersecurity attacks through which botmasters deploy distributed denial of service and advanced persistent threats against legitimate computer networks. In this paper we introduce the Host Attack Graph model and propose two botnet propagation strategies which we study across network topologies, target selection, and attack strategies together with their effectiveness in time. While strategy and botnet size are important for propagation, our study and simulations show that network topology and target selection should not be easily discarded. Implementation and benchmarks are available at https://codeberg.org/AndreiN/HAGP.
1 Introduction
The introduction frames botnet propagation as a major attack capability and presents a host-level model and strategies for studying how network structure and target selection shape it. It also highlights centrality as a way to characterize hosts’ unequal roles in infection spread.
1 Introduction
- Botnets are networks of compromised machines coordinated by botmasters for attacks including DDoS, data exfiltration, phishing, spam, advanced persistent threats, and propagation.Source: §1 · p. 1
- Botmasters coordinate bots through centralized, decentralized, or hybrid command-and-control arrangements, with servers used to issue commands and collect data.Source: §1 · p. 1
- Botnet capabilities depend on network structure and communication features, and hosts in different structural positions contribute unequally to infection spread.The introduction identifies degree, closeness, betweenness, and eigenvector centrality as measures of hosts’ relative importance.Source: §1 · p. 2
- The paper introduces Host Attack Graph (HAG), a method for computing root-compromise probabilities, the SIP model for network evolution, and two strategies for target selection and propagation.It also compares propagation across graph topologies, centralities, and strategies, and makes its code and datasets available.Source: §1 · p. 2
2 State of the art
The related work spans graph models, epidemic approaches, centrality-based spreading, and attack graphs. The paper distinguishes its host-specific compromise probabilities from models using a single infection rate or homogeneous edge probabilities.
2 State of the art
- Prior botnet structure work uses Erdős–Rényi, Watts–Strogatz, and Barabási–Albert graph families, which this paper uses to test propagation strategies.Source: §2 · p. 2
- A two-layer model reduces propagation factors to one infection rate, whereas this paper assigns each host a compromise probability from vulnerability-based attack paths.The cited study tested its model on Android malware and Conficker datasets.Source: §2 · pp. 2–3
- Cellular-automata work ranks centrality-based transmission strategies by infection efficiency, and this paper incorporates those strategies; a separate centrality study reports mostly positive correlations across unweighted networks.Source: §2 · p. 3
- Bayesian Attack Graphs model causality between network states, while a Reed–Frost model assumes one infection probability across edges and permanent removal; this paper includes vulnerability structure and attacker persistence.Source: §2 · p. 3
3 Modelling the Attack
The modeling framework estimates host-level root compromise from vulnerability attack paths, then simulates propagation across network topologies using centrality-based targeting strategies.
3.1 Host Attack Graph
- Each host is represented by vulnerability-success attributes and user/root goals; an attack path is a vulnerability chain whose successful exploitation reaches a goal.Source: §3.1 · pp. 4–5
- Root-compromise probability combines user-access probability with inclusion-exclusion over local root paths; exploit probabilities use a synthetic CVSS-based value whose modeling is out of scope.Source: §3.1 · pp. 4, 6
3.2 Network Model
- The network uses random, scale-free, or small-world topologies and SIP states; the susceptible frontier comprises hosts adjacent to infected nodes.Source: §3.2 · pp. 6–7
3.3 Propagation
- Each interval targets up to k frontier hosts using sticky top-k or centrality-weighted selection; centralities are computed at entry and held fixed.Source: §3.3 · pp. 7–8
4 Experiments
The experiments compare propagation strategies across graph topologies and show that attack budget, strategy, network size, and topology all shape propagation outcomes. They also report that percolation is less favorable than random in the tested scenarios and that larger graphs reduce variability in the owned fraction.
Experimental setup
- Experiments randomly assign host vulnerabilities and attack paths, hold graph size and edge count comparable across topologies, and compare sticky and weighted strategies with random baselines and an ideal strategy.Trials redraw attacker success chances while keeping each HAG and network topology constant.Source: §4 · p. 9
Attack scaling
- As k increases, centrality rankings become more visible, but attacker budget and sticky or weighted strategy matter more than victim choice.Figure 3 reports owned-host percentage across budgets, with propagation strategies in rows and graph topologies in columns.Source: §4 · p. 9, Figure 3 · p. 10
Topology and centrality
- In random graphs, degree, closeness, betweenness, and eigenvector centralities have Spearman correlations above 0.9.Percolation is identified as the outlier under the paper's formulation.Source: §4 · p. 10
Network size
- As graph size increases, the standard deviation of the average owned fraction shrinks, making strategy advantages across topologies easier to see.Figure 4 varies n with k = 1 and reports means over 100 trials; its rows represent strategies and columns topologies.Source: §4 · pp. 9–10, Figure 4 · p. 11
Propagation outcomes
- Weighted percolation's average owned fraction is comparable to its random counterpart, but percolation is less favorable across the tested scenarios.The percolation ranking counts shortest paths originating from the attacker.Source: §4 · p. 11
- In scale-free networks, a higher initial number of susceptible hosts is associated with a higher infection rate regardless of strategy.The paper notes that the attacker's chance of infiltrating the network is important in this setting.Source: §4 · p. 11
5 Conclusions and future directions
The paper introduces the Host Attack Graph model and two botnet propagation strategies, then studies them across network topologies. Simulations provide insights into topology's impact, while current methods show only modest improvements over the baseline.
Conclusions
- The Host Attack Graph estimates host compromise probabilities, and the paper proposes two propagation strategies alongside ideal and random-choice strategies for comparison.The simulations study propagation over random, scale-free, and small-world graphs.Source: §5 · p. 11
- Simulations show the effectiveness of the two strategies and provide insights into how network topology affects botnet propagation.The paper makes its code and data available online.Source: §5 · p. 12
Future directions
- Current methods provide only modest improvements over the baseline regardless of network topology; future work will integrate centralities into HAG and explore host budgets per bot and dynamic percolation.The authors also propose evaluating success by the value of targeted hosts, including isolated hosts holding useful data.Source: §5 · p. 12
Appendix
The examples calculate root compromise from user-compromise probability and root attack paths, while the continued experiments show propagation over time across graph types and sizes.
5.1 Host Attack Graph Examples
- The vulnerability table is a synthetic example based on recent Microsoft Windows vulnerabilities, intended only for demonstration, not actual attacks.Source: Table 1 · p. 14
- All four paths to user access depend on v2, so the example treats them as dependent rather than independent events.The example lists three paths to root access, conditional on user access.Source: §5.1 · p. 15
- 0.5972 ≈ 0.6 is the example HAG’s root-compromise probability, calculated from user-compromise probability 0.8198 and PPIE 0.72852.The example uses the probabilities of the root-access paths to compute PPIE.Source: §5.1 · p. 16
5.2 Spearman Experiments Continued
- The continued experiments complement Section 4 with smaller networks of n = 550, and Table 4 summarizes centrality measures, characteristics, and mathematical models.Source: §5.2 · p. 16, Table 4 · p. 16
- For n = 1024, the figures plot fraction of network owned over time for random and scale-free graphs, each with attacker budget k = 8.Source: §5.2 · p. 17
- For n = 550, the figures include random and small-world graphs with k = 1, and a scale-free graph with k = 8.The plots track fraction of network owned over time.Source: §5.2 · pp. 17, 19, Figure 6 · p. 18