Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces LNTest, a novel testbed designed to evaluate Bitcoin Lightning Network-based botnets, addressing gaps in understanding real-world network dynamics and resilience. Through controlled experiments, the authors reveal that the D-LNBot's autonomous formation protocol leads to clustered rather than uniform chains, and that command propagation scales linearly with botnet size, contradicting previous claims. Additionally, the study finds that the overlay topology significantly influences the effectiveness of takedown strategies, with the autonomous clustered chain proving to be the most vulnerable configuration.
Command propagation in LN-based botnets scales linearly with size, challenging previous assumptions about efficiency and resilience.
Bitcoin's Lightning Network (LN) can be exploited as a covert, low-cost command-and-control (C&C) channel for botnets, as demonstrated by the LNBot and D-LNBot designs. However, both remain proof-of-concept prototypes evaluated only through simulation, leaving key questions about real-world topology formation, propagation complexity, and resilience to takedowns unanswered. We present LNTest, the first reusable testbed for LN-based botnets, built from Core Lightning nodes containerized with Docker over a shared Bitcoin Core regtest chain. LNTest supports three overlay topology modes (a deterministic chain, autonomous peer discovery, and user-supplied graphs), enabling controlled experiments across different botnet structures. Using LNTest, we report three main findings. First, D-LNBot's autonomous formation protocol does not produce the uniform chain from its design; instead, it creates a clustered chain in which cliques are linked by bridge nodes whose removal fragments the network. Second, command propagation scales linearly with botnet size ($\Theta(n)$), not the $O(m \log n)$ previously claimed, and gains nothing from higher neighbor connectivity. Third, the overlay topology determines the effectiveness of takedown strategies: uniform-degree chains resist targeted removal but fragment under random failure, scale-free topologies show the opposite pattern, and the autonomous clustered chain is fragile under both, making it the most vulnerable of the three. LNTest is released as open source, with a script that reproduces all our experiments, to support reproducible research on LN-based botnet defenses.