Report: 鄭志欣 Conference: Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin Szydlowski, Richard Kemmerer, Chris Kruegel, and Giovanni Vigna, in Proceedings of the ACM CCS, Chicago, IL, November /9/8 1 Machine Learning and Bioinformatics Lab

 Date Collect : 2009/1/25 ~ 2009/2/5  180’000 infections  70GB data  USD$ 83,000 ~ 8,300,000 (bank account and credit card) 2015/9/8 2 Machine Learning and Bioinformatics Lab

 Introduction  Botnet Analysis  Threats and data analysis  Conclusion 2015/9/8Machine Learning and Bioinformatics Lab 3

 The main purpose of this paper is to analyze the Torpig botnet’s operations. Botnet size. The personal information is stolen by botnets. 2015/9/8Machine Learning and Bioinformatics Lab 4

 Torpig solves fast-flux by using a different technique for locating its C&C servers, which we refer to as domain flux. 2015/9/8Machine Learning and Bioinformatics Lab 5

 Data Collection and Format  Submission Header  Botnet Size vs. IP Count 2015/9/8Machine Learning and Bioinformatics Lab 6

 Date : 70GB (10 day)  Protocol : HTTP POST requests  Submission Header VS. Request body 2015/9/8Machine Learning and Bioinformatics Lab 7

2015/9/8Machine Learning and Bioinformatics Lab 8  Ts = time stamp  IP  Sport = SOCKS proxies port  Hport = HTTP port  OS = operation system version  Cn = locale  Nid = bot identifier  Bld and ver = build and version number of Torpig gh5

 2015/9/8Machine Learning and Bioinformatics Lab 9

 Counting Bots by Submission Header Fields  (nid, os, cn, bld, ver) decide to unique bot  Delete Probers and Researcher  hosts 2015/9/8Machine Learning and Bioinformatics Lab 10

2015/9/8Machine Learning and Bioinformatics Lab Bots / hour 705 Bots / hour

2015/9/8Machine Learning and Bioinformatics Lab 12

 DHCP (ISPs recycles IPs) 2015/9/8Machine Learning and Bioinformatics Lab 13

 Financial Data Stealing  Password Analysis 2015/9/8Machine Learning and Bioinformatics Lab 14

 In ten days, Torpig obtained the credentials of 8,310 accounts at 410 different institutions. The top targeted institutions were PayPal (1,770 accounts), Poste Italiane (765), Capital One (314), E*Trade (304), and Chase (217). 2015/9/8Machine Learning and Bioinformatics Lab 15

2015/9/8Machine Learning and Bioinformatics Lab 16

 we found that a naïve evaluation of botnet size based on the count of distinct IPs yields grossly overestimated results. 2015/9/8Machine Learning and Bioinformatics Lab 17

2015/9/8Machine Learning and Bioinformatics Lab 18