A large-scale empirical study of conficker

IEEE Transactions on Information Forensics and Security

Volumn 7, Issue 2, 2012, Pages 676-690

  Shin, Seungwon ^a   Gu, Guofei ^a   Reddy, Narasimha ^a   Lee, Christopher P ^b  

^a TEXAS A AND M UNIVERSITY   (United States)

^b Internet Systems Consortium Inc   (United States)

Author keywords

Botnet; botnet defense; botnet measurement; conficker

Indexed keywords

BOTNET; BOTNET DEFENSE; CONFICKER; DEFENSE STRATEGY; DISTRIBUTION PATTERNS; EMPIRICAL STUDIES; MALWARE PROPAGATION; MALWARES; POTENTIAL POWER; SECURITY ALERTS;

COMPUTER NETWORKS; SAFETY ENGINEERING;

COMPUTER CRIME;

EID: 84863368947     PISSN: 15566013     EISSN: None     Source Type: Journal    
DOI: 10.1109/TIFS.2011.2173486     Document Type: Conference Paper

References (39)

1. SPAMCOP.NET [Online]. Available: http://www.spamcop.net
2. The SPAMHAUS Project [Online]. Available: http://www.spamhaus.org
3. M. Antonakakis, R. Perdisci, D. Dagon, W. Lee, and N. Feamster, "Building a dynamic reputation system for DNS," in Proc. USENIX Security of Symp., Washington, DC, Aug. 2010.
4. BotLab. BotLab: A Study in Spam [Online]. Available: http://www.botlab. org
5. CAIDA. Conficker/Conflicker/Downadup as Seen From the UCSD Network Telescope [Online]. Available: http://www.caida.org/research/security/ms08-067/ conficker.xml
6. E. Chien, Downadup: Attempts at Smart Network Scanning [Online]. Available: http://www.symantec.com/connect/blogs/downadup-attempts- smart-network-scanning
7. DNSBL. Invaluement DNSBL (an Anti-Spam Blacklist) [Online]. Available: http://dnsbl.invaluement.com
8. Dshield. All Suspicious Source IPs in Dshield [Online]. Available: http://www.dshield.org/feeds/daily-sources
9. Dshield. Cooperative Network Security Community [Online]. Available: http://www.dshield.org
10. FIRE. Finding Rogue Networks [Online]. Available: http:// maliciousnetworks.org
11. Fortune. Fortune 100 companies [Online]. Available: http://money. cnn.com/magazines/fortune
12. G. Upton and I. Cook, Oxford Dictionary of Statistics, 2nd ed. London, U.K.: Oxford Univ. Press, 2006.
13. G. Gu, Z. Chen, P. Porras, and W. Lee, "Misleading and defeating importance- scanning malware propagation," in Proc. 3rd Int. Conf. Security and Privacy in Communication Networks (SecureComm'07), Nice, France, Sep. 2007.
14. T. Holz, C. Gorecki, and F. Freiling, "Detection and mitigation of fast-flux service networks," in Proc. Network and Distributed System Security Symp. (NDSS), San Diego, CA, Feb. 2008.
15. N. Ianelli and A. Hackworth, "Botnets as a vehicle for online crime," in Proc. Ann. FIRST Conf., Baltimore, MD, 2006.
16. S. Krishnan and Y. Kim, Passive identification of Conficker nodes on the Internet University of Minnesota, Technical Document, 2009.
17. J. Kristoff, "Experiences with Conficker C sinkhole operation and analysis," in Proc. Australian Computer Emergency Response Team Conf., Gold Coast, Australia, May 2009.
18. G. Maier, F. Schneider, and A. Feldmann, "NAT usage in residential broadband networks," in Proc. 12th Int. Conf. Passive and active measurement (PAM'11), Atlanta, GA, Mar. 2011.
19. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver, "Inside the Slammer worm," in Proc. IEEE Security and Privacy, Oakland, CA,May 2003.
20. D. Moore, C. Shannon, and K. Calffy, "Code-red: A case study on the spread and victims of an internet worm," in Proc. ACM SIGCOMM Workshop on Internet Measurement, Marseille, France, Nov. 2002.
21. B. N. Online. Clock Ticking onWorm Code [Online]. Available: http://news.bbc.co.uk/2/hi/technology/7832652.stm
22. P. Porras, H. Saidi, and V. Yegneswaran, "A foray into Conficker's logic and rendezvous points," in Proc. USENIX LEET, Boston, MA, Apr. 2009.
23. Z.Qian, Z.Mao, Y. Xie, andF.Yu, "On network-level clusters for spam detection," in Proc. Network and Distributed System Security Symp. (NDSS), San Diego, CA, Feb. 2010.
24. Z. Qian, Z. Mao, Y. Xie, and F. Yu, "Spam mitigation using spatiotemporal reputations fromblacklist history," in Proc. Annual Computer Security Applications Conf. (ACSAC), Austin, TX, Dec. 2010.
25. A. Ramachandran and N. Feamster, "Understanding the network-level behavior of spammers," in Proc. ACM SIGCOMM, Pisa, Italy, Sep. 2006.
26. SecureWorks. Ozdok/Mega-D Trojan Analysis [Online]. Available: http://www.secureworks.com/research/threats/ozdok/?threat=ozdok
27. C. Shannon and D. Moore, "The spread of the Witty worm," in Proc. IEEE Security and Privacy, Oakland, CA, May 2004.
28. SORBS. Fighting Spam by Finding and Listing Exploitable Servers [Online]. Available: http://www.au.sorbs.net
29. SRI-International. An analysis of Conficker C [Online]. Available: http://mtc.sri.com/Conficker/addendumC
30. B. Stock, J. Goebel, M. Engelberth, F. C. Freiling, and T. Holz, "Walowdac analysis of a peer-to-peer botnet," in Proc. Eur. Conf. Computer Network Defense (EC2ND), Milan, Italy, Nov. 2009.
31. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna, "Your botnet is my botnet: Analysis of a botnet takeover," in Proc. ACM CCS, Chicago, IL, Nov. 2009.
32. Symantec. Trojan.Srizbi [Online]. Available: http://www.symantec.com/ security-response/writeup.jsp?docid=2007-062007-0946-99
33. M. S. Techcenter. Conficker worm [Online]. Available: http://technet. microsoft.com/en-us/security/dd452420.aspx
34. Tmetric. Bandwidth Maeasurement Tool [Online]. Available: http://mbacarella.blogspot.com/projects/tmetric
35. UPI. Virus strikes 15 million PCs [Online]. Available: http://www.upi.com/Top-News/2009/01/26/Virus-strikes-15-million-PCs/UPI- 19421232924206
36. Verisign. The Domain Name Industry Brief [Online]. Available: http://www.verisign.com/domain-name-services/domain-information- center/domain-name-resources/domain-name-report-sept09.pdf.
37. D.Watson, Know Your Enemy: Containing Conficker [Online]. Available: http://www.honeynet.org/papers/conficker
38. Y. Xie, F. Yu, K. Achan, E. Gillum, M. Goldzmidt, and T. Wobber, "How dynamic are IP addresses?," in Proc. ACM SIGCOMM, Kyoto, Japan, Aug. 2007.
39. Y. Xie, F. Yu, K. Achan, R. Panigraphy, G. Hulte, and I. Osipkov, "Spamming botnets: Signatures and characteristics," in Proc. ACM SIGCOMM, Seattle, WA, Aug. 2008.