Presentation is loading. Please wait.

Presentation is loading. Please wait.

A Survey of Botnet Size Measurement PRESENTED: KAI-HSIANG YANG ( 楊凱翔 ) DATE: 2013/11/04 1/24.

Published byJake Picking Modified over 9 years ago

Similar presentations

Presentation on theme: "A Survey of Botnet Size Measurement PRESENTED: KAI-HSIANG YANG ( 楊凱翔 ) DATE: 2013/11/04 1/24."— Presentation transcript:

1 A Survey of Botnet Size Measurement PRESENTED: KAI-HSIANG YANG ( 楊凱翔 ) DATE: 2013/11/04 1/24

2 Basic Information Title: - A Survey of Botnet Size Measurement Author & Institution: - Shangdong Liu (Jiangsu Province Southeast University) - Jian Gong - Wang Yang - Ahmad Jakalan Publication: Second International Conference on Networking and Distributed Computing Year: 2011 Cited (Google): 2 2/24

3 Problems to Solve 1. Botnets have exerted serious threat against cyber-security. 2. Botnet size is one of the most important characteristics to evaluate the threat of botnet. 3. As far as the size of botnet is concerned, it is more difficult to calculate. 4. A great many of challenges to measure botnet size still exist, for example, how to eliminate the influence of DDNS, NAT, DHCP and botnet migration or clone? 3/24

4 Outline - INTRODUCTION - MEASUREMENT OF BOTNET LIVE POPULATION - MEASUREMENT OF BOTNET FOOTPRINT - DYNAMIC TRACKING OF BOTNET SIZE - AREA ISSUE OF BOTNET SIZE - SUMMARY 4/24

5 Outline - INTRODUCTION - MEASUREMENT OF BOTNET LIVE POPULATION - MEASUREMENT OF BOTNET FOOTPRINT - DYNAMIC TRACKING OF BOTNET SIZE - AREA ISSUE OF BOTNET SIZE - SUMMARY 5/24

6 Definition of Botnet Size The definition of botnet size has been clearly proposed by M. A. Rajab in the meeting of USENIX HotBots 2007. 1. Footprint: Refers to the overall size of infected population of botnet at any time in its lifetime. Range of infection 2. Live population: The number of live bots simultaneously present in C2 channel. Attack volume 6/24

7 Issues for Measurement of Botnet Size 1. The measurement of botnet live population. 2. The measurement of botnet footprints. 3. Dynamic tracing of botnet size. 4. Area issue of botnet size. 7/24

8 Outline - INTRODUCTION - MEASUREMENT OF BOTNET LIVE POPULATION - MEASUREMENT OF BOTNET FOOTPRINT - DYNAMIC TRACKING OF BOTNET SIZE - AREA ISSUE OF BOTNET SIZE - SUMMARY 8/24

9 Three Classes of Methods 1. Detection methods based on active/passive DNS detection 2. Detection methods based on botnet C2 features 3. Detection methods based on correlation of multiple bases 9/24

10 Active DNS Detection Based on actively utilizing domain name of C2 controller. Take DNS redirection for example, 1. Map the domain name of botnet C2 server to prepared sinkhole 2. Records all the connections between bots and C2 server 3. Count the number of hosts who take connections 4. The live population of the botnet can be obtained 10/24

11 Methods based on botnet C2 features One of the examples exploring spam to detect is method by analyzing spam content. 1. Hunting hosts which send a large amount of e-mail in the short term on mail servers 2. These hosts will be judged to suspects 3. The mails embedded with same key URL will be classified as spam from the same botnet 4. Counting the spammers from one botnet will obtain the botnet’s live population 11/24

12 Methods based on correlation of multiple bases BotHunter The basic idea is: By capturing the data exchange, generated in the process of spread and attack of botnet, between inside and outside of network border, “chain of evidence” of botnet activity will be formed through correlating the captured data exchange according to the botnet working process. 95.1% of detection rate can be reached! 12/24

13 Outline - INTRODUCTION - MEASUREMENT OF BOTNET LIVE POPULATION - MEASUREMENT OF BOTNET FOOTPRINT - DYNAMIC TRACKING OF BOTNET SIZE - AREA ISSUE OF BOTNET SIZE - SUMMARY 13/24

14 How to calculate botnet footprint? Solution 1: Determine whether hosts are infected by botnet, and then take count of infected hosts. Solution 2: Statistical inference is usually the only choice to calculate botnet footprint. Not accurate! Till this survey is written, there are no literatures which focus on accurate estimation of offline hosts in observed network. 14/24

15 Outline - INTRODUCTION - MEASUREMENT OF BOTNET LIVE POPULATION - MEASUREMENT OF BOTNET FOOTPRINT - DYNAMIC TRACKING OF BOTNET SIZE - AREA ISSUE OF BOTNET SIZE - SUMMARY 15/24

16 Aspects of dynamically tracking botnet size 1. Means or patterns of botnet propagation 2. Obfuscation produced by some botnet activities, such as botnet clone and botnet migration 3. Dynamic model of botnet 16/24

17 Scanning manner of botnet - A propagation way: Vulnerability scanning 1. Worm class: A way using more primitive style through which botnet has large scanning volume and holds a large amount of infected hosts in short time. 2. Non-worm class: Integrated with a variety of scanning algorithm, including scanning on a network segment, hit- list and random scanning. The amount of infections caused by non-worm scanning is less than worm class scanning, but the detection is more difficult. 17/24

18 Detection of IRC botnets The multiple IRC bots collections detected by communication between C2 controller and bots, due to the existence of botnet clone, migration and hierarchical management, these collections might belong to a same botnet. The algorithm uses: 1. Distance of communication’s characteristics 2. Overlap rate of bots 3. IP aggregation (Calculate “Overlap rate of bots”) More accurate footprint can be obtained by this method for 89% of IRC botnets. 18/24

19 Detection of IRC botnets - Advantages: Resolve migration, clone and hierarchical management issues of IRC botnet. - Disadvantages: 1. Multiple collections of bots should be known before using the algorithm 2. It is only applicable for the botnets with centralized structure. 19/24

20 Outline - INTRODUCTION - MEASUREMENT OF BOTNET LIVE POPULATION - MEASUREMENT OF BOTNET FOOTPRINT - DYNAMIC TRACKING OF BOTNET SIZE - AREA ISSUE OF BOTNET SIZE - SUMMARY 20/24

21 Area Issues of Botnet Size - Live population, footprint of botnet also have regional issues (local or global). - Global footprints need to consider the impact of time zones. - Two approaches to calculate the global size of botnet: 1. Statistical inference 2. Empirical estimation 21/24

22 Problems still to be solved - Unresolved problems of tracking botnet size include… 1. Dynamic IP addresses and NAT addresses. 2. How to track entire life cycle while every stages in life cycle have different characteristics. 3. How to identify botnets detected at different time in the existence of botnet clone and migration. 22/24

23 Outline - INTRODUCTION - MEASUREMENT OF BOTNET LIVE POPULATION - MEASUREMENT OF BOTNET FOOTPRINT - DYNAMIC TRACKING OF BOTNET SIZE - AREA ISSUE OF BOTNET SIZE - SUMMARY 23/24

24 Summary - The measurement of botnet size is not an isolated problem. It is related closely with capturing of bot programs, botnet detection and behavior analysis of botnet etc. - Just as blind men touching an elephant, each way to measure botnet size reflects only a perspective of observation. 24/24

Download ppt "A Survey of Botnet Size Measurement PRESENTED: KAI-HSIANG YANG ( 楊凱翔 ) DATE: 2013/11/04 1/24."

Similar presentations

Wenke Lee and Nick Feamster Georgia Tech Botnet and Spam Detection in High-Speed Networks.

Wenke Lee and Nick Feamster Georgia Tech Botnet and Spam Detection in High-Speed Networks.
Wenke Lee and Nick Feamster Georgia Tech Botnet and Spam Detection in High-Speed Networks.

Wenke Lee and Nick Feamster Georgia Tech Botnet and Spam Detection in High-Speed Networks.
Network Security Highlights Nick Feamster Georgia Tech.

Network Security Highlights Nick Feamster Georgia Tech.
Performance Assessment

Performance Assessment
Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS Traces Roberto Perdisci, Igino Corona, David Dagon, Wenke Lee ACSAC.

Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS Traces Roberto Perdisci, Igino Corona, David Dagon, Wenke Lee ACSAC.
An Introduction of Botnet Detection – Part 2 Guofei Gu, Wenke Lee (Georiga Tech)

An Introduction of Botnet Detection – Part 2 Guofei Gu, Wenke Lee (Georiga Tech)
Phishing for Phish in the Phispond A lab on understanding Phishing attacks and defenses … Group 21-B Sagar Mehta.

Phishing for Phish in the Phispond A lab on understanding Phishing attacks and defenses … Group 21-B Sagar Mehta.
MOSQUITO BREEDING ATTACK: Spread of bots using Peer To Peer INSTRUCTOR: Dr.Cliff Zou PRESENTED BY : BHARAT SOUNDARARAJAN & AMIT SHRIVATSAVA.

MOSQUITO BREEDING ATTACK: Spread of bots using Peer To Peer INSTRUCTOR: Dr.Cliff Zou PRESENTED BY : BHARAT SOUNDARARAJAN & AMIT SHRIVATSAVA.
1 MA Rajab, J Zarfoss, F Monrose, A Terzis - Proceedings of the First USENIX Workshop on Hot Topics in Understanding Botnets My Botnet is Bigger than Yours.

1 MA Rajab, J Zarfoss, F Monrose, A Terzis - Proceedings of the First USENIX Workshop on Hot Topics in Understanding Botnets My Botnet is Bigger than Yours.
1 A Spam Mail-based Solution for Botnet Detection and Network Bandwidth Protection 許富皓 資訊工程學系 中央大學 1.

1 A Spam Mail-based Solution for Botnet Detection and Network Bandwidth Protection 許富皓 資訊工程學系 中央大學 1.
BotMiner Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee College of Computing, Georgia Institute of Technology.

BotMiner Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee College of Computing, Georgia Institute of Technology.
Report on Intrusion Detection and Data Fusion By Ganesh Godavari.

Report on Intrusion Detection and Data Fusion By Ganesh Godavari.
Wide-scale Botnet Detection and Characterization Anestis Karasaridis, Brian Rexroad, David Hoeflin.

Wide-scale Botnet Detection and Characterization Anestis Karasaridis, Brian Rexroad, David Hoeflin.
Understanding the Network-Level Behavior of Spammers Mike Delahunty Bryan Lutz Kimberly Peng Kevin Kazmierski John Thykattil By Anirudh Ramachandran and.

Understanding the Network-Level Behavior of Spammers Mike Delahunty Bryan Lutz Kimberly Peng Kevin Kazmierski John Thykattil By Anirudh Ramachandran and.
1 Authors: Anirudh Ramachandran, Nick Feamster, and Santosh Vempala Publication: ACM Conference on Computer and Communications Security 2007 Presenter:

1 Authors: Anirudh Ramachandran, Nick Feamster, and Santosh Vempala Publication: ACM Conference on Computer and Communications Security 2007 Presenter:
2009/9/151 Rishi : Identify Bot Contaminated Hosts By IRC Nickname Evaluation Reporter : Fong-Ruei, Li Machine Learning and Bioinformatics Lab In Proceedings.

2009/9/151 Rishi : Identify Bot Contaminated Hosts By IRC Nickname Evaluation Reporter : Fong-Ruei, Li Machine Learning and Bioinformatics Lab In Proceedings.
Team Excel What is SPAM ?. Spam Offense Team Excel '‘a distinctive chopped pork shoulder and ham mixture'' Image Source:Appscout.com.

Team Excel What is SPAM ?. Spam Offense Team Excel '‘a distinctive chopped pork shoulder and ham mixture'' Image Source:Appscout.com.
1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do.

1. Introduction The underground Internet economy Web-based malware The system analyzing the post-infection network behavior of web-based malware How do.
BOTNETS & TARGETED MALWARE Fernando Uribe. INTRODUCTION  Fernando Uribe   IT trainer and Consultant for over 15 years specializing.

BOTNETS & TARGETED MALWARE Fernando Uribe. INTRODUCTION  Fernando Uribe   IT trainer and Consultant for over 15 years specializing.
1 Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling - Proceedings.

1 Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling - Proceedings.

Similar presentations

Ads by Google