|
Characterizing the IRC-based Botnet Phenomenon
Zhuge, Jianwei
;
Holz, Thorsten
;
Han, Xinhui
;
Guo, Jinpeng
;
Zou, Wei
|
Körperschaften:
|
Lehrstuhl für Praktische Informatik 1
|
|
URL:
|
https://ub-madoc.bib.uni-mannheim.de/1710
|
|
URN:
|
urn:nbn:de:bsz:180-madoc-17104
|
|
Dokumenttyp:
|
Arbeitspapier
|
|
Erscheinungsjahr:
|
2007
|
|
Titel einer Zeitschrift oder einer Reihe:
|
None
|
|
Sprache der Veröffentlichung:
|
Englisch
|
|
Einrichtung:
|
Fakultät für Wirtschaftsinformatik und Wirtschaftsmathematik > Sonstige - Fakultät für Wirtschaftsinformatik und Wirtschaftsmathematik
|
|
MADOC-Schriftenreihe:
|
Veröffentlichungen der Fakultät für Mathematik und Informatik > Institut für Informatik > Technical Reports
|
|
Fachgebiet:
|
004 Informatik
|
|
Fachklassifikation:
|
CCS:
K.6.5,
D.4.6,
|
|
Normierte Schlagwörter (SWD):
|
Computersicherheit , Malware
|
|
Freie Schlagwörter (Englisch):
|
Botnets , Honeypots , Measurement study
|
|
Abstract:
|
Botnets, networks of compromised machines that can be remotely controlled by an attacker, are one of the most common attack platforms nowadays. They can, for example, be used to launch distributed denial-of-service (DDoS) attacks, steal sensitive information, or send spam emails. A long-term measurement study of botnet activities is useful as a basis for further research on global botnet mitigation and disruption techniques. We have built a distributed and fully-automated botnet measurement system which allows us to collect data on the botnet activity we observe in China. Based on the analysis of tracking records of 3,290 IRC-based botnets during a period of almost twelve months, this paper presents several novel results of botnet activities which can only be measured via long-term measurements. These include. amongst others, botnet lifetime, botnet discovery trends and distributions, command and control channel distributions, botnet size and end-host distributions. Furthermore, our measurements confirm and extend several previous results from this area. Our results show that the botnet problem is of global scale, with a scattered distribution of the control infrastructure and also a scattered distribution of the victims. Furthermore, the control infrastructure itself is rather flexible, with an average lifetime of a Command \& Control server of about 54 days. These results can also leverage research in the area of botnet detection, mitigation, and disruption: only by understanding the problem in detail, we can develop efficient counter measures.
|
 | Das Dokument wird vom Publikationsserver der Universitätsbibliothek Mannheim bereitgestellt. |
 Suche Autoren in
BASE:
Zhuge, Jianwei
;
Holz, Thorsten
;
Han, Xinhui
;
Guo, Jinpeng
;
Zou, Wei
Google Scholar:
Zhuge, Jianwei
;
Holz, Thorsten
;
Han, Xinhui
;
Guo, Jinpeng
;
Zou, Wei
Sie haben einen Fehler gefunden? Teilen Sie uns Ihren Korrekturwunsch bitte hier mit: E-Mail
Actions (login required)
 |
Eintrag anzeigen |
|
![[img]](https://madoc.bib.uni-mannheim.de/style/images/fileicons/application_pdf.png)