1. Report: 鄭志欣 Conference: Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin Szydlowski, Richard Kemmerer, Chris Kruegel, and Giovanni Vigna, in Proceedings of the ACM CCS, Chicago, IL, November 2009. 2015/9/8 1 Machine Learning and Bioinformatics Lab

2.  Date Collect : 2009/1/25 ~ 2009/2/5  180’000 infections  70GB data  USD$ 83,000 ~ 8,300,000 (bank account and credit card) 2015/9/8 2 Machine Learning and Bioinformatics Lab

3.  Introduction  Botnet Analysis  Threats and data analysis  Conclusion 2015/9/8Machine Learning and Bioinformatics Lab 3

4.  The main purpose of this paper is to analyze the Torpig botnet’s operations. Botnet size. The personal information is stolen by botnets. 2015/9/8Machine Learning and Bioinformatics Lab 4

5.  Torpig solves fast-flux by using a different technique for locating its C&C servers, which we refer to as domain flux. 2015/9/8Machine Learning and Bioinformatics Lab 5

6.  Data Collection and Format  Submission Header  Botnet Size vs. IP Count 2015/9/8Machine Learning and Bioinformatics Lab 6

7.  Date : 70GB (10 day)  Protocol : HTTP POST requests  Submission Header VS. Request body 2015/9/8Machine Learning and Bioinformatics Lab 7

8. 2015/9/8Machine Learning and Bioinformatics Lab 8  Ts = time stamp  IP  Sport = SOCKS proxies port  Hport = HTTP port  OS = operation system version  Cn = locale  Nid = bot identifier  Bld and ver = build and version number of Torpig gh5

9.  2015/9/8Machine Learning and Bioinformatics Lab 9

10.  Counting Bots by Submission Header Fields  (nid, os, cn, bld, ver) decide to unique bot  Delete Probers and Researcher  18200 hosts 2015/9/8Machine Learning and Bioinformatics Lab 10

11. 2015/9/8Machine Learning and Bioinformatics Lab 11 4690 Bots / hour 705 Bots / hour

12. 2015/9/8Machine Learning and Bioinformatics Lab 12

13.  DHCP (ISPs recycles IPs) 2015/9/8Machine Learning and Bioinformatics Lab 13

14.  Financial Data Stealing  Password Analysis 2015/9/8Machine Learning and Bioinformatics Lab 14

15.  In ten days, Torpig obtained the credentials of 8,310 accounts at 410 different institutions. The top targeted institutions were PayPal (1,770 accounts), Poste Italiane (765), Capital One (314), E*Trade (304), and Chase (217). 2015/9/8Machine Learning and Bioinformatics Lab 15

16. 2015/9/8Machine Learning and Bioinformatics Lab 16

17.  we found that a naïve evaluation of botnet size based on the count of distinct IPs yields grossly overestimated results. 2015/9/8Machine Learning and Bioinformatics Lab 17

18. 2015/9/8Machine Learning and Bioinformatics Lab 18