Countering Botnets: Anomaly-Based Detection, Comprehensive Analysis, and Efficient Mitigation

TitleCountering Botnets: Anomaly-Based Detection, Comprehensive Analysis, and Efficient Mitigation
Publication TypeReports
Year of Publication2011
AuthorsLee W, Dagon D, Giffin J, Feamster N, Ollman G, Westby J, Wesson R, Vixie P
Date Published2011/05//
InstitutionGEORGIA TECH RESEARCH CORP ATLANTA
Keywords*ELECTRONIC SECURITY, *INFORMATION SECURITY, *INTERNET, *INTRUSION DETECTION(COMPUTERS), algorithms, BGP ROUTE INJECTION, BGP(BORDER GATEWAY PROTOCOLS), BOTNET DETECTION, BOTNET TRACEBACK AND ATTRIBUTION, BOTNETS(MALWARE), CLIENT SERVER SYSTEMS, COMMUNICATIONS PROTOCOLS, COMPUTER PROGRAMMING AND SOFTWARE, COMPUTER SYSTEMS MANAGEMENT AND STANDARDS, CYBER ATTACKS, CYBER SECURITY, CYBERNETICS, CYBERTERRORISM, CYBERWARFARE, DATA PROCESSING SECURITY, DNS BASED MONITORING, DNS BASED REDIRECTION, DNS(DOMAIN NAME SYSTEMS), INFORMATION SCIENCE, INTERNET BROWSERS, ISP(INTERNET SERVICE PROVIDERS), MALWARE, MALWARE ANALYSIS, Online Systems, WUAFRLDHS1BOTN
Abstract

We cover five general areas: (1) botnet detection, (2) botnet analysis, (3) botnet mitigation, (4) add-on tasks to the original contract, including the Conficker Working Group Lessons Learned, Layer-8 Exploration of Botnet Organization, and DREN research, and (5) commercialization in this paper. We have successfully developed new botnet detection and analysis capabilities in this project. These algorithms have been evaluated using real-world data, and have been put into actual, deployed systems. The most significant technical developments include a new dynamic reputation systems for DNS domains, a scalable anomaly detection system for botnet detection in very large network, and a transparent malware analysis system. In addition, on several occasions we have used our botnet data and analysis to help law enforcement agencies arrest botmasters. We also have had great success transitioning technologies to commercial products that are now used by government agencies, ISPs, and major corporations.
URLhttp://stinet.dtic.mil/oai/oai?&verb=getRecord&metadataPrefix=html&identifier=ADA543919