Maarten Weyns
info
Please Note
<p>This page displays the records of the person named above and is not linked to a unique person identifier. This record may need to be merged to a profile.</p>
3 records found
1
Exploring the Gorillas in the Malware Jungle
Investigating the communication and attack characteristics of the Gorilla botnet
Master thesis
(2025)
-
Maarten Weyns, G. Smaragdakis, H.J. Griffioen, D. Ferrero, S. Op de Beek, M.A. Migut
The rise of the Internet of Things (IoT) has introduced levels of convenience never seen before, but also presents a significant cybersecurity challenge. Especially the insecure nature of many of these IoT devices fuels the emergence of advanced IoT botnets. The Gorilla botnet is a potent example of such IoT botnets and took the internet by surprise in September 2024. That month alone, Gorilla has been responsible for over 300,000 Distributed Denial-of-Service (DDoS) attacks across 100 countries. Although inspired by earlier botnets like Mirai and Gafgyt, Gorilla exhibits unique characteristics and attack strategies that remain largely unexplored.
This thesis conducts a detailed analysis of the Gorilla botnet, focusing on its communication patterns, infection strategies, and attack behaviors. By executing Gorilla’s malware samples in a controlled environment, the study captures insights into its command-and-control (C2) communication and attack strategies. Key findings include the identification of a flaw in Gorilla’s implementation, which could aid future detection efforts, and the discovery of its preference for UDP-based attacks targeting gaming-related services.
Through this work, we contribute a dataset and analysis framework that sheds light on Gorilla’s operations, highlighting its similarities to and deviations from the original Mirai botnet. The findings provide insightful observations, enabling improvements in defenses against IoT botnet threats. ...
This thesis conducts a detailed analysis of the Gorilla botnet, focusing on its communication patterns, infection strategies, and attack behaviors. By executing Gorilla’s malware samples in a controlled environment, the study captures insights into its command-and-control (C2) communication and attack strategies. Key findings include the identification of a flaw in Gorilla’s implementation, which could aid future detection efforts, and the discovery of its preference for UDP-based attacks targeting gaming-related services.
Through this work, we contribute a dataset and analysis framework that sheds light on Gorilla’s operations, highlighting its similarities to and deviations from the original Mirai botnet. The findings provide insightful observations, enabling improvements in defenses against IoT botnet threats. ...
The rise of the Internet of Things (IoT) has introduced levels of convenience never seen before, but also presents a significant cybersecurity challenge. Especially the insecure nature of many of these IoT devices fuels the emergence of advanced IoT botnets. The Gorilla botnet is a potent example of such IoT botnets and took the internet by surprise in September 2024. That month alone, Gorilla has been responsible for over 300,000 Distributed Denial-of-Service (DDoS) attacks across 100 countries. Although inspired by earlier botnets like Mirai and Gafgyt, Gorilla exhibits unique characteristics and attack strategies that remain largely unexplored.
This thesis conducts a detailed analysis of the Gorilla botnet, focusing on its communication patterns, infection strategies, and attack behaviors. By executing Gorilla’s malware samples in a controlled environment, the study captures insights into its command-and-control (C2) communication and attack strategies. Key findings include the identification of a flaw in Gorilla’s implementation, which could aid future detection efforts, and the discovery of its preference for UDP-based attacks targeting gaming-related services.
Through this work, we contribute a dataset and analysis framework that sheds light on Gorilla’s operations, highlighting its similarities to and deviations from the original Mirai botnet. The findings provide insightful observations, enabling improvements in defenses against IoT botnet threats.
This thesis conducts a detailed analysis of the Gorilla botnet, focusing on its communication patterns, infection strategies, and attack behaviors. By executing Gorilla’s malware samples in a controlled environment, the study captures insights into its command-and-control (C2) communication and attack strategies. Key findings include the identification of a flaw in Gorilla’s implementation, which could aid future detection efforts, and the discovery of its preference for UDP-based attacks targeting gaming-related services.
Through this work, we contribute a dataset and analysis framework that sheds light on Gorilla’s operations, highlighting its similarities to and deviations from the original Mirai botnet. The findings provide insightful observations, enabling improvements in defenses against IoT botnet threats.
Journal article
(2023)
-
Andrés Murillo, Riccardo Taormina, Nils Ole Tippenhauer, Davide Salaorni, Robert van Dijk, Luc Jonker, Simcha Vos, Maarten Weyns, Stefano Galelli
Numerical simulation models are a fundamental tool for planning and managing smart water networks—an evolution of water distribution systems in which physical assets are monitored and controlled by information and communication technologies. While simulation models allow us to understand the interactions between physical processes and abstract control strategies, they ignore key implementation aspects of distributed control systems, such as the required communication over digital links. As a result, the effects of anomalies and faults in the communication on the process control cannot be investigated with existing tools. In this work, we fill this gap by introducing DHALSIM (Digital HydrAuLic SIMulator), a numerical modelling platform combining EPANET-based process simulation with a network and host emulation environment, offering a high-fidelity representation of the processes occurring in the cyber domain. We illustrate DHALSIM’s key functionalities by implementing it on a benchmark water distribution system, present case studies of simulated network traffic, and demonstrate how anomalies in the behavior of the communication network affect the process data received by the supervisory control and data acquisition (SCADA) server. In a companion paper, we further illustrate how DHALSIM enables research opportunities in the domain of cyber-physical security. The easily customizable and open source DHALSIM provides a “workbench” for studying smart water networks, developing digital twins, and designing a broad spectrum of engineering solutions.
...
Numerical simulation models are a fundamental tool for planning and managing smart water networks—an evolution of water distribution systems in which physical assets are monitored and controlled by information and communication technologies. While simulation models allow us to understand the interactions between physical processes and abstract control strategies, they ignore key implementation aspects of distributed control systems, such as the required communication over digital links. As a result, the effects of anomalies and faults in the communication on the process control cannot be investigated with existing tools. In this work, we fill this gap by introducing DHALSIM (Digital HydrAuLic SIMulator), a numerical modelling platform combining EPANET-based process simulation with a network and host emulation environment, offering a high-fidelity representation of the processes occurring in the cyber domain. We illustrate DHALSIM’s key functionalities by implementing it on a benchmark water distribution system, present case studies of simulated network traffic, and demonstrate how anomalies in the behavior of the communication network affect the process data received by the supervisory control and data acquisition (SCADA) server. In a companion paper, we further illustrate how DHALSIM enables research opportunities in the domain of cyber-physical security. The easily customizable and open source DHALSIM provides a “workbench” for studying smart water networks, developing digital twins, and designing a broad spectrum of engineering solutions.
In order to be able to use the Microsoft HoloLens for surgical navigation purposes, performing good patient alignment is of utmost importance. This paper will discuss how this patient alignment can be done using different point cloud registration algorithms.
A lot of research is being conducted on point cloud registration algorithms. However, most research assumes that the point clouds to be aligned are almost identical, while patient alignment aims at aligning a very detailed pre-operative scan with a very sparse point cloud obtained by the surgeon using an optical marker.
In order to get around this problem, the HoloLens' depth camera is used to obtain a detailed point cloud so that registration algorithms can be used. Then the performance of different point cloud registration algorithms is tested on this depth sensor data to see whether using the HoloLens' depth sensor is a viable option for patient alignment.
From the results, it appears that algorithmic approaches for performing patient alignment are feasible, but the performance of these algorithms is very dependent on the quality of the input data. ...
A lot of research is being conducted on point cloud registration algorithms. However, most research assumes that the point clouds to be aligned are almost identical, while patient alignment aims at aligning a very detailed pre-operative scan with a very sparse point cloud obtained by the surgeon using an optical marker.
In order to get around this problem, the HoloLens' depth camera is used to obtain a detailed point cloud so that registration algorithms can be used. Then the performance of different point cloud registration algorithms is tested on this depth sensor data to see whether using the HoloLens' depth sensor is a viable option for patient alignment.
From the results, it appears that algorithmic approaches for performing patient alignment are feasible, but the performance of these algorithms is very dependent on the quality of the input data. ...
In order to be able to use the Microsoft HoloLens for surgical navigation purposes, performing good patient alignment is of utmost importance. This paper will discuss how this patient alignment can be done using different point cloud registration algorithms.
A lot of research is being conducted on point cloud registration algorithms. However, most research assumes that the point clouds to be aligned are almost identical, while patient alignment aims at aligning a very detailed pre-operative scan with a very sparse point cloud obtained by the surgeon using an optical marker.
In order to get around this problem, the HoloLens' depth camera is used to obtain a detailed point cloud so that registration algorithms can be used. Then the performance of different point cloud registration algorithms is tested on this depth sensor data to see whether using the HoloLens' depth sensor is a viable option for patient alignment.
From the results, it appears that algorithmic approaches for performing patient alignment are feasible, but the performance of these algorithms is very dependent on the quality of the input data.
A lot of research is being conducted on point cloud registration algorithms. However, most research assumes that the point clouds to be aligned are almost identical, while patient alignment aims at aligning a very detailed pre-operative scan with a very sparse point cloud obtained by the surgeon using an optical marker.
In order to get around this problem, the HoloLens' depth camera is used to obtain a detailed point cloud so that registration algorithms can be used. Then the performance of different point cloud registration algorithms is tested on this depth sensor data to see whether using the HoloLens' depth sensor is a viable option for patient alignment.
From the results, it appears that algorithmic approaches for performing patient alignment are feasible, but the performance of these algorithms is very dependent on the quality of the input data.