CT-M: A Real-Time Botnet Monitoring Infrastructure

大规模僵尸网络已经成为互联网上的一大祸害。僵尸网络从事各种有害活动，包括发起DDoS攻击、实施点击欺诈、传播广告软件和发送大量垃圾邮件。尽管人们对僵尸网络的认识越来越高，但我们对僵尸网络的理解仍然存在漏洞，无论是在宏观属性方面，还是在跟踪和挫败特定攻击的能力方面。作为该项目的一部分，我们通过建立一个监控系统来收集和分发有关问题的客观数据，以此来应对僵尸网络威胁。我们的工作提供了三个新颖的贡献。首先，我们解决了构建实时僵尸网络监控平台所涉及的许多挑战。例如，我们的系统执行活的僵尸网络节点，因此，它必须防止这些节点对互联网上的其他主机造成伤害。其次，我们实现了几个原型防御工具，这些工具利用了平台提供的实时信息。第三，我们的工作通过从多个角度分析僵尸网络并将攻击向量与实验室中执行的真实僵尸的观察相关联，揭示了僵尸网络生态系统的丰富纹理，从而提高了我们对僵尸网络的理解，并使反僵尸网络防御策略成为可能。因此，它是发展可信赖的网络的关键一步，这种网络可以支持比今天的因特网上的更广泛的多样化的用途。

Large-scale botnets have become a blight on the Internet. Botnets engage in a variety of harmful activities, including initiating DDoS attacks, committing click fraud, propagating adware, and sending enormous volumes of spam. Though there is an increasing awareness of botnets, there are gaping holes in our understanding of botnets, both in terms of macroscopic properties as well as the ability to track and thwart specific attacks.As part of this project, we develop a response to the botnet threat by building a monitoring system that gathers and distributes objective data on the problem. Our work offers three novel contributions. First, we solve many of the challenges involved in building a real-time botnet monitoring platform. For example, our system executes live botnet nodes, and as such, it must prevent these nodes from causing harm to other hosts on the Internet. Second, we implement several prototype defensive tools that take advantage of the real-time information provided by the platform. Third, our work exposes the rich texture of the botnet ecosystem by analyzing botnets from multiple perspectives and by correlating the attack vectors with observations of real bots executed in laboratory settings.Our botnet monitoring platform thus advances our understanding of botnets and enables promising anti-botnet defense tactics. It thus serves as a crucial step in the development of a trustworthy network that can support a much wider diversity of uses than can be found on today's Internet.