1. A MULTIFACETED APPROACH TO UNDERSTANDING THE BOTNET PHENOMENON Moheeb Abu Rajab, Jay Zarfoss, Fabian Monrose & Andreas Terzis IMC’06

2. Outline  Problem  Related Work  Botnet Infection Life Cycle  The Multifaceted Approach  Results  Conclusion

3. Problem  Botnet behavior has never been methodically studied.  Botnet prevalence is a mystery.  No accurate models for the Botnet life cycle

4. Related Work  Honeynets  Multi-step approach to counter DDOS originating from botnets  Malware collection infrastructures

5. Botnet Infection Life Cycle

6. The Multifaceted Approach 1) Malware Collection 2) Binary analysis via gray-box testing 3) Longitudinal tracking of IRC botnets via IRC Trackers and DNS tracking

7. Data Collection Architecture

8. Binary analysis via graybox testing  Phase 1: Creation of a network fingerprint Fnet = {DNS, IPs, Ports, Scan)  Phase 2: Creation of an IRC fingerprint Firc = {PASS, NICK, USER, MODE, JOIN}

9. Results – Effective Botnet Size

10. Results  11% of 800,000 Examined DNS domains are infected.  Relative frequency of commands Command TypeFrequency (%) Control33 Scanning28 Cloning15 Mining7 Download7 Attack7 Other3

11. Conclusion  IRC Botnets are a major contributor to unwanted traffic.  Effective sizes ranges from few hundreds to few thousands.  Footprints are usually larger than effective sizes.  Today’s botnets include self protection mechanisms and support multiple vector attacks