Modeling Botnet Propagation Using Time Zones Published by: Cliff Zou, David Dagon, Wenke Lee Presentation by: Corey Kuwanoe
Outline Background Data Collection Model Experiments Practical Usage Time Zone Diurnal Experiments Practical Usage
Background Botnets
Background (cont.) Heterogeneous Victims obtained through Viruses Worms Trojans
Data Collection Command and Control Servers Honeypots DNS manipulation
Time Zone Modeling Diurnal Shaping Function (t) Fraction of vulnerable computers online at time t Periodical function 24 hr period
Diurnal Model for Single Time Zone I(t) Number of infected hosts S(t) Number of vulnerable hosts N(t) Number of hosts that were originally vulnerable
Diurnal Model for Single Time Zone (cont.) I’(t) (t)I(t) # of online infected hosts S’(t) (t)S(t) # of online vulnerable hosts N’(t) (t)N(t) # of online hosts from N(t)
Diurnal Model for Single Time Zone (cont.) Worm propagation dynamics Worm propagation diurnal model = proportion of scan rate / ip space = removal parameter
Diurnal Model for Single Time Zone (cont.)
Diurnal Model for Multiple Time Zones Groups 24 groups for 24 hours
Experiments Botnet Grouping 350k members Random scanning Single Domain North America Asia Europe
Experiments (cont.)
Experiments (cont.)
Experiments (cont.)
Experiments (cont.) Automatically derive (t) Break down botnet traffic by region Process regional data Split dataset into segments Normalize data in segments Average data in segments Remove monitor noise Normalize result Place (t) in database
Experiments (cont.)
Practical Uses Time for releasing a worm Predict future propagation
Practical Uses (cont.)
Practical Uses (cont.)
Practical Uses (cont.)
Practical Uses (cont.) Successfully predicts dynamics of botnets Not infected populations
Contributions Simple and intuitive model Accurate predictions of future propagation
Weaknesses Only accurate for scanning worms Email worms/viruses pose a problem to model Predictions are only good for a limited amount of time Does not address multiple infection vectors