Lawful Detection, Investigation, and Prosecution of Botnet-related Crime

合法侦查、调查和起诉僵尸网络相关犯罪

• 批准号: 457175502
• 负责人: Professor Dr. Dominik Brodowski
• 金额: --
• 依托单位: Lehrstuhl für Rechtsinformatik
• 依托单位国家: 德国
• 项目类别: Research Grants
• 资助国家: 德国
• 项目状态: 未结题
• 来源: https://gepris.dfg.de/gepris/projekt/457175502?language=en
• 关键词: Lawful; Detection; Investigation; Prosecution; Botnet

Botnets are a highly useful tool for committing cyber crime offences: several IT systems infected by malware (bots) are connected to a network (botnet) under the control of a command-and-control infrastructure; this network may then be used to commit further crimes. Although the infection of an IT system with malware is oftentimes already a crime, the detection of botnets as well as the prosecution of botnet-related crimes and the prevention of (further) damages is a serious challenge for law enforcement authorities. The overarching goal of this research project is to determine and evolve the legal and IT framework for the interaction between law enforcement authorities and network operators in the furtherance of detecting, investigating and prosecuting botnet-related crime.For the sub-project on criminal and security law, the main research questions are the interaction between criminal law and police law in addressing botnet-related crime, whether and to what extent private entities such as network operators may be involved, and how the so-called security law is emerging in this area. To address these research questions, the major criminal law, criminal procedure, and police law requirements and limitations on interactions between law enforcement authorities and private entities will be analyzed, taking full account of the constitutional and European framework.The sub-project on data protection analyzes how much data may be gathered by a network provider for anomaly-based intrusion detection systems, without violating provisions on the protection of personally identifying information. In particular, research will focus on limitations to analyzing DNS requests stemming from the use of the network by (natural) persons. Additionally, we will investigate how cross-network and cross-domain collaborative intrusion detection of botnets, in particular using anomaly-based detection, may be implemented in conformity with technical and legal frameworks of data protection, and what role authorities – such as the BSI – may play.

僵尸网络是实施网络犯罪的一个非常有用的工具：被恶意软件（僵尸程序）感染的几个IT系统连接到一个网络（僵尸网络），由一个命令和控制基础设施控制;这个网络然后可能被用来实施进一步的犯罪。虽然IT系统感染恶意软件通常已经是一种犯罪，但检测僵尸网络以及起诉僵尸网络相关犯罪和防止（进一步）损害对执法当局来说是一个严峻的挑战。该研究项目的总体目标是确定和发展执法当局和网络运营商之间互动的法律的和IT框架，以促进侦查、调查和起诉僵尸网络相关犯罪。网络运营商等私营实体是否以及在多大程度上可能参与，以及所谓的安全法如何在这一领域出现。为了解决这些研究问题，主要的刑法，刑事诉讼法和警察法的要求和限制之间的互动执法机关和私人实体将进行分析，充分考虑到宪法和欧洲的框架。关于数据保护的子项目分析了多少数据可以收集的网络提供商为基于异常的入侵检测系统，不违反个人身份信息保护的规定。特别是，研究将侧重于分析（自然人）使用网络产生的DNS请求的限制。此外，我们将研究如何跨网络和跨域的僵尸网络的协作入侵检测，特别是使用基于异常的检测，可以实现符合技术和法律的框架的数据保护，以及什么样的角色当局-如BSI -可能发挥。