1. Brett Stone-GrossBrett Stone-Gross, Christopher Kruegel, Kevin AlmerothChristopher KruegelKevin Almeroth University of California, Santa Barbara Andreas Moser, Technical University Vienna Engin KirdaEngin Kirda, Institute Eurecom ACSAC Dec 2009 A Presentation at Advanced Defense Lab

2. Outline Introduction Data Collection Data Analysis Evaluation Related Work Conclusions Advanced Defense Lab2 http://maliciousnetworks.org

3. Introduction Bullet-proof hosting (Ex. RBN) Criminals’ fear Usage Mechanism (malscore) Key: longevity Advanced Defense Lab3

4. Data Collection – Botnet C&C Tool [Anubis]Anubis IRC-based botnets HTTP-based botnets Pushdo Cutwail Advanced Defense Lab4

5. Data Collection – Drive-by- Download Hosting Providers Tool [Wepawet]Wepawet Computer Security Company [Spamcop]Spamcop Capture Honey Pot Client (HPC) VMs (Windows XP without updates) Advanced Defense Lab5

6. Data Collection – Phish Hosting Providers Tool [PhishTank]PhishTank Threshold Time – One week Advanced Defense Lab6

7. Data Analysis Time will tell between the rogue and legitimate networks. Advanced Defense Lab7

8. Data Analysis Advanced Defense Lab8

9. Data Analysis Advanced Defense Lab9

10. Data Analysis Advanced Defense Lab10

11. Data Analysis Threshold – δ IPs that are active less than δ are discarded. Apply to Botnet phishing Advanced Defense Lab11

12. Malscore Computation Once per day, FIRE produces 3 lists Li. The issue of “Size” of an AS. Cooperative Association for Internet Data Analysis Advanced Defense Lab12

13. Evaluation - Correctness Advanced Defense Lab13 [ShadowServer Foundation]ShadowServer Foundation [Google’s Safe Browsing]Google’s Safe Browsing [ZeusTracker]ZeusTracker

14. Evaluation - Completeness What we missing ? Advanced Defense Lab14

15. Choosing Fine Threshold Advanced Defense Lab15

16. No Threshold Required Advanced Defense Lab16

17. Choosing Fine Parameter - C Advanced Defense Lab17

18. Related Work The Road of the King Distinguish between compromised and deliberately malicious networks. Identify networks that are operated by criminals. Different filtering techniques Advanced Defense Lab18

19. Conclusions A novel system to automatically identify and expose organizations and ISPs that demonstrate persistent, malicious behavior. Refine the collected data and correlate it to deduce the level of maliciousness for the identified networks. Advanced Defense Lab19

20. Thank You Advanced Defense Lab20