Sciweavers

Share
IMC
2007
ACM

Using uncleanliness to predict future botnet addresses

8 years 12 months ago
Using uncleanliness to predict future botnet addresses
The increased use of botnets as an attack tool and the awareness attackers have of blocking lists leads to the question of whether we can effectively predict future bot locations. To that end, we introduce a network quality that we term uncleanliness: an indicator of the propensity for hosts in a network to be compromised by outside parties. We hypothesize that unclean networks will demonstrate two properties: spatial and temporal uncleanliness. Spatial uncleanliness is the tendency for compromised hosts to cluster within unclean networks. Temporal uncleanliness is the tendency for unclean networks to contain compromised hosts for extended periods. We test for these properties by collating data from multiple indicators (spamming, phishing, scanning and botnet IRC log monitoring). We demonstrate evidence for both spatial and temporal uncleanliness. We further show evidence for cross-relationship between the various datasets, showing that botnet activity predicts spamming and scanning,...
M. Patrick Collins, Timothy J. Shimeall, Sidney Fa
Added 26 Oct 2010
Updated 26 Oct 2010
Type Conference
Year 2007
Where IMC
Authors M. Patrick Collins, Timothy J. Shimeall, Sidney Faber, Jeff Janies, Rhiannon Weaver, Markus De Shon, Joseph B. Kadane
Comments (0)
books