A MULTIFACETED APPROACH TO UNDERSTANDING THE BOTNET PHENOMENON Moheeb Abu Rajab, Jay Zarfoss, Fabian Monrose & Andreas Terzis IMC’06

Outline  Problem  Related Work  Botnet Infection Life Cycle  The Multifaceted Approach  Results  Conclusion

Problem  Botnet behavior has never been methodically studied.  Botnet prevalence is a mystery.  No accurate models for the Botnet life cycle

Related Work  Honeynets  Multi-step approach to counter DDOS originating from botnets  Malware collection infrastructures

Botnet Infection Life Cycle

The Multifaceted Approach 1) Malware Collection 2) Binary analysis via gray-box testing 3) Longitudinal tracking of IRC botnets via IRC Trackers and DNS tracking

Data Collection Architecture

Binary analysis via graybox testing  Phase 1: Creation of a network fingerprint Fnet = {DNS, IPs, Ports, Scan)  Phase 2: Creation of an IRC fingerprint Firc = {PASS, NICK, USER, MODE, JOIN}

Results – Effective Botnet Size

Results  11% of 800,000 Examined DNS domains are infected.  Relative frequency of commands Command TypeFrequency (%) Control33 Scanning28 Cloning15 Mining7 Download7 Attack7 Other3

Conclusion  IRC Botnets are a major contributor to unwanted traffic.  Effective sizes ranges from few hundreds to few thousands.  Footprints are usually larger than effective sizes.  Today’s botnets include self protection mechanisms and support multiple vector attacks