Automating Analysis of Large-Scale Botnet Probing Events
When looking for automating botnet analysis I found this great paper “Automating Analysis of Large-Scale Botnet Probing Events”. This paper is from ASIACCS’09 March 10-12, 2009, Sydney, NSW, Australia. You can download it from : http://www.icir.org/vern/papers/probing-analy.ccs09.pdf
Abstract [Copied and pasted from the above link]:
Botnets dominate today’s attack landscape. In this work we investigate ways to analyze collections of malicious probing trafic inorder to understand the signifcance of large-scale “botnet probes”. In such events, an entire collection of remote hosts together probes the address space monitored by a sensor in some sort of coordinated fashion. Our goal is to develop methodologies by which sites receiving such probes can infer-using purely local observation-information about the probing activity: What scanning strategies does the probing employ? Is this an attack that specifcally targets the site, or is the site only incidentally probed as part of a larger, indiscriminant attack?
Our analysis draws upon extensive honeynet data to explore the prevalence of different types of scanning, including properties such as trend, uniformity, coordination, and darknet avoidance. In addition, we design schemes to extrapolate the global properties of scanning events (e.g., total population and target scope) as inferred from the limited local view of a honeynet. Cross-validating with data from DShield shows that our inferences exhibit promising accuracy.
Really nice read for someone who wants to understand more about automation part of analysis of large scale botnet events. This is something towards which most of the Security Operation Centers (SOCs) are moving towards to provide a cost effective solution, instead of outsourcing the services completely. We hope that you enjoy reading the paper. Thank you for choosing Botnet Analytics!
