Towards situational awareness of large-scale botnet probing events

IEEE Transactions on Information Forensics and Security

Volumn 6, Issue 1, 2011, Pages 175-188

  Li, Zhichun ^a   Goyal, Anup ^b   Chen, Yan ^c   Paxson, Vern ^d  

^a NEC LABORATORIES AMERICA   (United States)

^b YAHOO RESEARCH   (United States)

^c Northwestern University   (United States)

^d UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

Botnet; computer network security; global property extrapolation; honeynet; scan strategy inference; site security monitoring; situational awareness; statistical inference

Indexed keywords

BOTNET; GLOBAL PROPERTIES; HONEYNET; SCAN STRATEGY INFERENCE; SITE SECURITY MONITORING; SITUATIONAL AWARENESS; STATISTICAL INFERENCE;

EXTRAPOLATION; INTERNET; PROBES; SCANNING; STATISTICAL METHODS;

NETWORK SECURITY;

EID: 79951817047     PISSN: 15566013     EISSN: None     Source Type: Journal    
DOI: 10.1109/TIFS.2010.2086445     Document Type: Article

References (28)

1. Adrian Lamo Charged With Computer Crimes [Online]. Available: http://www.securityfocus.com/news/6888
2. R. Pang, V. Yegneswaran, P. Barford, V. Paxson, and L. Peterson, "Characteristics of internet background radiation," in Proc. ACM IMC, Taormina, Sicily, Italy, 2004.
3. K. Chiang and L. Lloyd, "A case study of the rustock rootkit and spam bot," in Proc. USENIX Hot Bots, Atlanta, GA, 2007.
4. M. Rajab, J. Zarfoss, F. Monrose, and A. Terzis, "A multifaceted approach to understanding the botnet phenomenon," in Proc. ACM IMC, Rio de Janeiro, Brazil, 2006.
5. SANS Institute, Dshield.org: Distributed Intrusion Detection System [Online]. Available: http://www.dshield.org/
6. N. Provos, "A virtual honeypot framework," in Proc. USENIXSecurity, San Diego, CA, 2004.
7. P. Bacher, T. Holz, M. Kotter, and G. Wicherski, Know Your Enemy: Tracking Botnets [Online]. Available: http://www.honeynet.org/papers/bots
8. J. Kannan et al., "Semi-automated discovery of application session structure," in Proc. ACM IMC, Rio de Janeiro, Brazil, 2006.
9. V. Yegneswaran, P. Barford, and V. Paxson, "Using honeynets for internet situational awareness," in Proc. ACM Hotnets IV, College Park, MD, 2005.
10. Z. Li, A. Goyal, Y. Chen, and A. Kuzmanovic, "Measurement and diagnosis of address-misconfigured P2P traffic," in Proc. IEEE INFOCOM, San Diego, CA, 2010.
11. C. C. Zou et al., "Monitoring and early warning for internet worms," in Prof. ACM CCS, Washington, DC, 2003.
12. P. Barford and V. Yegneswaran, An Inside Look at Botnets, ser. In Series: Advances in Information Security. New York: Springer, 2006.
13. S. Staniford et al., "How to own the internet in your spare time," in Proc. USENIX Security, San Francisco, CA, 2002.
14. M. G. Kendall, Rank Correlation Methods. London, U.K.: Griffin, 1976.
15. J. A. Rice, Mathematical Statistics and Data Analysis. Belmont, CA: Duxbury Press, 1994.
16. W. E. Weisstein, Stirling Number of the Second Kind [Online]. Available: http://mathworld.wolfram.com/StirlingNumberoftheSecondKind.html
17. J. Bethencourt, J. Franklin, and M. Vernon, "Mapping internet sensors with probe response attacks," in Proc. USENIX Security, Baltimore, MD, 2005.
18. J. Cai, V. Yesneswaran, C. Alfeld, and P. Barfard, Honeynets and Honeygames: A Game Theoretic Approach to Defending Network Monitors University ofWiscconsin, Tech. Rep. TR1577, 2006.
19. OS Platform Statistics by W3school [Online]. Available: http://www. w3schools.com/browsers/browsers-stats.asp
20. AP Market Sharing [Online]. Available: http://news.com.com/Microsofts+Wi- Fi+ups+and+downs/2100-1039-3-994518
21. S. Bellovin et al., "A technique for counting NATted hosts," in Proc. USENIX/ACM IMW, Marseille, France, 2002.
22. Net-Worm.Win32Allaple.a [Online]. Available: http://www.viruslist. com/en/viruses/encyclopedia?virusid=145521
23. Z. Li, A. Goyal, Y. Chen, and V. Paxson, "Automating analysis of large-scale botnet probing events," in Proc. ACM Asia CCS, Sydney, Australia, 2009.
24. S. Katti, B. Krishnamurhy, and D. Katabi, "Collaborating against common enemies," in Proc. ACMIMC, Berkeley, CA, 2005.
25. Honey Bow Sensor [Online]. Available: http://honeybow.mwcollect.org
26. Honeysnap [Online]. Available: http://www.honeynet.org/tools/honeysnap/ index.html
27. D. Moore et al., "Inside the slammer worm," IEEE Security Privacy Mag., vol. 1, no. 4, pp. 33-39, 2003.
28. A. Kumar, V. Paxson, and N. Weaver, "Exploiting underlying structure for detailed reconstruction of an internet scale event," in Proc. ACM IMC, Berkeley, CA, 2005.