A Multifaceted Approach to Understanding the Botnet Phenomenon
This is a great paper that we came across last week, when we were trying to understand the botnet phenomenon for implementing across the multi-stage botnet analysis tool that is in the process of development.
ABSTRACT
The academic community has long acknowledged the existence of malicious botnets, however to date, very little is known about the behavior of these distributed computing platforms. To the best of our knowledge, botnet behavior has never been methodically studied, botnet prevalence on the Internet is mostly a mystery, and the botnet life cycle has yet to be modeled. Uncertainty abounds. In this paper, we attempt to clear the fog surrounding botnets by constructing a multifaceted and distributed measurement infrastructure. Throughout a period of more than three months, we used this infrastructure to track 192 unique IRC botnets of size ranging from a few hundred to several thousand infected end-hosts. Our results show that botnets represent a major contributor to unwanted Internet traffic—27% of all malicious connection attempts observed from our distributed darknet can be directly attributed to botnetrelated spreading activity. Furthermore, we discovered evidence of botnet infections in 11% of the 800,000 DNS domains we examined, indicating a high diversity among botnet victims. Taken as a whole, these results not only highlight the prominence of botnets, but also provide deep insights that may facilitate further research to curtail this phenomenon.
We thought of sharing this with our readers. It has been really busy in researching and developing the tool that would be releasing soon. You could find the above paper at the following link:
http://www.cs.jhu.edu/~fabian/papers/botnets.pdf
Stay tuned for more update on the tools that we would be releasing soon. Thank you for choosing botnet analytics!
Dave Kennedy
You did see that this paper is four years old right?