Collaborative Research: CT-ISG: Modeling and Measuring Botnets

“僵尸网络是一个由被入侵的计算机或机器人组成的网络，被敌对的僵尸主机征用。僵尸网络是许多攻击的罪魁祸首，包括垃圾邮件、网络钓鱼、密钥记录和拒绝服务。该项目旨在开发技术来模拟和测量僵尸网络传播和在线人口动态。了解僵尸网络的发展趋势、规模和分布位置，有助于评估僵尸网络的潜在威胁，并选择和优先处理相应的响应措施。虽然互联网蠕虫经常被用来创建僵尸网络，但它们之间有着根本的区别。蠕虫通常被设计为感染尽可能多的机器，并且通常是“嘈杂的”并且容易被检测到（并且因此被移除）;而僵尸网络被设计为逃避检测，并且尽可能长时间地控制和利用受危害的机器。现有的蠕虫模型集中在蠕虫的初始/短传播阶段。但是一个好的僵尸网络模型需要长期跟踪僵尸网络在线种群的动态。第一种是开发日模型，利用时区和脆弱系统的分布等因素来跟踪僵尸网络在线数量的增长和下降趋势。第二是开发采样和测量方法，包括捕获和重新捕获和DNS缓存窥探，以估计僵尸网络的总人口。第三是制定威胁评估措施，例如，其聚合带宽和响应弹性，基于系统、机器人的位置和拓扑信息。"

"A botnet is a network of compromised computers, or bots, commandeered by an adversarial botmaster. Botnets are responsible for many attacks, including spam, phishing, key logging, and denial of service. This project aims to develop techniques to model and measure botnet propagation and on-line population dynamics. Knowing the trend, size, and locations of the population of a botnet can help estimate the potential threat of a botnet, and select and prioritize the appropriate response actions.Although Internet worms are often used to create botnets, there is fundamental difference between them. Worms are typically designed to infect as many machines as possible, and are in general "noisy" and easily detected (and thus removed); whereas botnets are designed to evade detection, and control and make use of the compromised machines for as long as possible. The existing worm models focus on the initial/short propagation phase of a worm. But a good botnet model needs to track the dynamics of botnet online population in the long run.This project has three main tasks. The first is to develop diurnal models to track the grow-and-decline trend of botnet on-line population using factors such as time zones and distribution of vulnerable systems. The second is to develop sampling and measurement approaches including capture-and-recapture and DNS cache snooping to estimate the total population of a botnet. The third is to develop measures for threat assessment, e.g., its aggregated bandwidth and resilience to response, based on the system, location and topology information of the bots."