A taxonomy of botnet structures

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2007, Pages 325-338

  Dagon, David ^a   Gu, Ofei ^a   Lee, Christopher P ^a   Lee, Wenke ^a  

^a GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNETS; COMPUTER SECURITY APPLICATIONS; P2P NETWORKS; PERFORMANCE METRICS; RANDOM GRAPHS; REMEDIATION STRATEGIES; SCALE-FREE; SCALE-FREE NETWORKS; STRUCTURAL SOLUTIONS;

ENVIRONMENTAL ENGINEERING; GRAPH THEORY; SECURITY SYSTEMS; TAXONOMIES;

COMPUTER APPLICATIONS;

EID: 48649089769     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2007.44     Document Type: Conference Paper

References (64)

1. Waste: Anonymous, secure, encrypted sharing. http://waste.sourceforge. net/index.php?id=projects, 2007.
2. WineHQ: Windows API Implementation for Li5Dnux. http://www.winehq.com/, 2007.
3. A.-L. Barabási and R. Albert. Emergence of scaling in random networks. Science, 286(509), 1999.
4. R. Albert and A.-L. Barabási. Statistical mechanics of complex networks. Reviews of Modern Physics, 74(1), 2002.
5. R. Albert, H. Jeong, and A.-L. Barabási. Error and attack tolerance of complex networks. Nature, 406:378-382, 2000.
6. M. Allman and V. Paxson. On estimating end-to-end network path properties. In ACM Special Interest Group on Data Communication (SIGCOMM '99), volume 29, 1999.
7. M. Bacarella. TMetric bandwidth estimation tool. http://michael. bacarella.com/projects/tmetric/, 2007.
8. P. Barford and V. Yegneswaran. An inside look at botnets. In In Series: Advances in Information Security. Springer Verlag, 2006.
9. V. Berk, R. Gray, and G. Bakos. Using sensor networks and data fusion for early detection of active worms. In Proceedings of the SPIE AeroSense, 2003.
10. B. Bollobás. Random Graphs. Academic Press, 1985.
11. D. Brumley. Tracking hackers on IRC. http://www.doomdead.com/texts/ ircmirc/TrackingHackersonIRC.htm, 2003.
12. E. Calimbo. Packetnews: The ultimate irc search engine. http://www.packetnews.com/, 2007.
13. E. Cooke and F. Jahanian. The zombie roundup: Understanding, detecting, and disrupting botnets. In Steps to Reducing Unwanted Traffic on the Internet Workshop (SRUTI '05), 2005.
14. D. Dagon. The network is the infection. http://www.caida.org/projects/ oarc/200507/slides/oarc0507-D\agon.pdf, 2005.
15. D. Dagon, A. Takar, G. Gu, X. Qin, and W. Lee. Worm population control through periodic response. Technical report, Georgia Institute of Technology, June 2004.
16. D. Dagon, C. Zou, and W. Lee. Modeling botnet propagation using time zones. In Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS'06), 2006.
17. F. C. Freiling, T. Holz, and G. Wicherski. Botnet tracking: Exploring a root-cause methodology to prevent distributed denial-of-service attacks. Technical Report ISSN-0935-3232, RWTH Aachen, April 2005.
18. J. Goebel and T. Holz. Rishi: Identify bot contaminated hosts by irc nickname evaluation. In USENIX Workshop on Hot Topics in Understanding Botnets (HotBots'07), 2007.
19. J. B. Grizzard, V. Sharma, C. Nunnery, B. B. Kang, and D. Dagon. Peer-to-peer botnets: Overview and case study. In USENIX Workshop on Hot Topics in Understanding Botnets (HotBots'07), 2007.
20. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee. Bothunter: Detecting malware infection through ids-driven dialog correlation. In 16th USENIX Security Symposium (Security' 07), 2007.
21. G. Gu, M. Sharif, X. Qin, D. Dagon, W. Lee, and G. Riley. Worm detection, early warning and response based on local victim information. In 20th Annual Computer Security Applications Conference (ACSAC), 2004.
22. C. Hanna. Using snort to detect rogue IRC bot programs. Technical report, October 2004.
23. P. Holme, B. J. Kim, C. N. Yoon, and S. K. Han. Attack vulnerability of complex networks. Phys. Rev., E65(056109), 2002.
24. J. Horrigan. Broadband adoption at home in the united states: Growing but slowing. http://web.si.umich.edu/tprc/papers/2005/501/TPRC\%20Horrigan\ %20Broadband.2005b.pdf, 2005.
25. M. Jain and C. Dovrolis. End-to-end available bandwidth: Measurement. methodology, dynamics, and relation with tcp. In Special Interest Group on Data Communication (SIGCOMM '02), 2002.
26. X. Jiang, D. Xu, H. J. Wang, and E. H. Spafford. Virtual playgrounds for worm behavior investigation. Technical Report CERIAS Technical Report (2005-24), Purdue University, February 2005.
27. C. Kalt. Internet relay chat: Architecture. http://www.faqs.org/rfcs/ rfc2810.html, 2000.
28. A. Karasaridis, B. Rexroad, and D. Hoeflin. Wide-scale botnet detection and characterization. In USENIX Workshop on Hot Topics in Understanding Botnets (HotBots'07), 2007.
29. K. Killourhy, R. Maxion, and K. Tan. A defense-centric taxonomy based on attack manifestations. In International Conference on Dependable Systems and Networks (ICDS'04), 2004.
30. C. E. Landwehr, A. R. Bull, J. P. McDermott, and W. S. Choi. A taxonomy of computer program security flaws, September 1994.
31. U. Lindqvist and E. Jonsson. How to systematically classify computer security intrusions. In Proceedings of the 1997 IEEE Symposium on Security and Privacy, pages 154-163, 1997.
32. LURHQ. Zindos worm analysis. http://www.lurhq.com/zindos.html, 2004.
33. Q. Lv, P. Cao, E. Cohen, K. Li, and S. Shenker. Search and replication in unstructured peer-to-peer networks. In ICS '02: Proceedings of the 16th international conference on Super-computing, pages 84-95, New York, NY, USA, 2002. ACM Press.
34. MaxMind LLC. Maxmind - ip geolocation and online fraud prevention. http://www.maxmind.com/, 2007.
35. T. Micro. Taxonomy of botnet threats. Technical report, Trend Micro White Paper, November 2006.
36. S. Milgram. The small world problem. Psychology Today, 2(60), 1967.
37. D. Moore. Code-red: A case study on the spread and victims of an internet worm. http://www.icir.org/vern/imw-2002/imw2002-papers/209.ps.gz, 2002.
38. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. Inside the slammer worm. IEEE Magazine on Security and Privacy, 1(4), July 2003.
39. D. Moore, C. Shannon, G. M. Voelker, and S. Savage. Internet quarantine: Requirements for containing self-propagating code. In Proceedings of the IEEE INFOCOM 2003, March 2003.
40. S. Nagarja and R. Anderson. The topology of covert conflict. Technical Report UCAM-CL-TR-637, University of Cambridge, July 2005.
41. J. Nazario. Botnet tracking: Tools, techniques, and lessons learned. In Black Hat, 2007.
42. M. Newman, S. Strogatz, and D. Watts. Random graphs with arbitrary degree distributions and their applications. Phys. Rev., E64(026118), 2001.
43. Nielsen NetRatings. Average web usage. http://www.nielsen-netratings.com/ reports.jsp?section=pub_reports&report=usage&period=weekly, 2007.
44. J. J. Parekh. Columbia ids worminator project. http://worminator.cs. columbia.edu/, 2004.
45. L. Qin, C. Pei, E. Cohen, L. Kai, and S. Scott. Search and replication in unstructured peer-to-peer networks. In 16th ACM International Conference on Supercomputing, 2002.
46. M. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. A multifaceted approach to understanding the botnet phenomenon. In Proceedings of the 6th ACM SIGCOMM on Internet Measurement (IMC), pages 41-52, 2006.
47. M. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. My botnet is bigger than yours (maybe, better than yours): Why size estimates remain challenging. In USENIX Workshop on Hot Topics in Understanding Botnets (HotBots'07), 2007.
48. S. Ratnasamy, P. Francis, M. Handley, R. Karp, and S. Shenker. A scalable content-addressable network. In Proceedings of the ACM Conference of the Special Interest Group on Data Communication (SIGCOMM), pages 161-172, August 2001.
49. M. Ripeanu, I. Foster, and A. Iamnitchi. Mapping the gnutella network: Properties of large-scale peer-to-peer systems and implications for system design. IEEE Internet Computing Journal, 6(1), 2002.
50. C. Shannon and D. Moore. The spread of the witty worm. Security & Privacy Magazine, 2(4):46-50, 2004.
51. A. Singh, T.-W. Ngan, P. Druschel, and D. Wallach. Eclipse attacks on overlay networks: Threats and defenses. In Proceedings of INFOCOM'06, April 2006.
52. I. Stoica, R. Morris, D. Karger, M. F. Kaashoek, and H. Balakrishnan. Chord: A scalable peer-to-peer lookup service for internet applications. In Proceedings of the ACM SIGCOMM '01 Conference, San Diego, California, August 2001.
53. R. Vogt and J. Aycock. Attack of the 50 foot botnet. Technical report, Department of Computer Science, University of Calgary, August 2006.
54. R. Vogt, J. Aycock, and M. Jacobson. Army of botnets. In Proceedings of NDSS'07, 2007.
55. P. Wang, S. Sparks, and C. C. Zou. An advanced hybrid peer-to-peer botnet. In USENIX Workshop on Hot Topics in Understanding Botnets (HotBots'07), 2007.
56. D. Watts and S. Strogatz. Nature, 393(440), 1998.
57. N. Weaver, V. Paxson, S. Staniford, and R. Cunningham. A taxonomy of computer worms. In 2003 ACM Workshop on Rapid Malcode (WORM'03). ACM SIGSAC, October 2003.
58. Y. Xie, H.-A. Kim, D. R. O'Hallaron, M. K. Reiter, and H. Zhang. Seurat: A pointillist approach to network security, 2004.
59. Y. Zhang and V. Paxson. Detecting stepping stones. In Proceedings of the 9th USENIX Security Symposium, August 2000.
60. C. Zou and R. Cunningham. Honeypot-aware advanced botnet construction and maintenance. In International Conference on Dependable Systems and Networks (DSN), pages 199-208, June 2006.
61. C. Zou, D. Towsley, W. Gong, and S. Cai. Routing worm: A fast, selective attack worm based on ip address information. Technical Report TR-03-CSE-06, Umass ECE Dept., November 2003.
62. C. C. Zou, L. Gao, W. Gong, and D. Towsley. Monitoring and early warning for internet worms. In Proceedings of 10th ACM Conference on Computer and Communications Security (CCS'03), October 2003.
63. C. C. Zou, W. Gong, and D. Towsley. Code red worm propagation modeling and analysis. In Proceedings of 9th ACM Conference on Computer and Communications Security (CCS'02), October 2002.
64. C. C. Zou, W. Gong, and D. Towsley. Worm propagation modeling and analysis under dynamic quarantine defense. In Proceedings of ACM CCS Workshop on Rapid Malcode (WORM'03), October 2003.