CT-M: A Real-Time Botnet Monitoring Infrastructure

大规模的僵尸网络已经成为互联网上的一个祸害。 僵尸网络从事各种有害活动，包括发起DDoS攻击、实施点击欺诈、传播广告软件和发送大量垃圾邮件。 虽然有越来越多的僵尸网络的认识，有我们的理解，无论是在宏观属性以及跟踪和阻止特定攻击的能力方面的漏洞。作为本项目的一部分，我们开发了一个响应僵尸网络的威胁，通过建立一个监测系统，收集和分发有关问题的客观数据。 我们的工作提供了三个新的贡献。 首先，我们解决了构建实时僵尸网络监控平台所面临的许多挑战。 例如，我们的系统执行活僵尸网络节点，因此，它必须防止这些节点对互联网上的其他主机造成伤害。 其次，我们实现了几个原型防御工具，利用该平台提供的实时信息。 第三，我们的工作揭示了僵尸网络生态系统的丰富纹理，从多个角度分析僵尸网络，并通过相关的攻击向量与实验室环境中执行的真实的机器人的观察。我们的僵尸网络监测平台，从而提高我们对僵尸网络的理解，使有前途的反僵尸网络防御策略。 因此，它是发展一个值得信赖的网络的关键一步，该网络能够支持比今天的互联网上所能找到的更广泛的多种用途。

Large-scale botnets have become a blight on the Internet. Botnets engage in a variety of harmful activities, including initiating DDoS attacks, committing click fraud, propagating adware, and sending enormous volumes of spam. Though there is an increasing awareness of botnets, there are gaping holes in our understanding of botnets, both in terms of macroscopic properties as well as the ability to track and thwart specific attacks.As part of this project, we develop a response to the botnet threat by building a monitoring system that gathers and distributes objective data on the problem. Our work offers three novel contributions. First, we solve many of the challenges involved in building a real-time botnet monitoring platform. For example, our system executes live botnet nodes, and as such, it must prevent these nodes from causing harm to other hosts on the Internet. Second, we implement several prototype defensive tools that take advantage of the real-time information provided by the platform. Third, our work exposes the rich texture of the botnet ecosystem by analyzing botnets from multiple perspectives and by correlating the attack vectors with observations of real bots executed in laboratory settings.Our botnet monitoring platform thus advances our understanding of botnets and enables promising anti-botnet defense tactics. It thus serves as a crucial step in the development of a trustworthy network that can support a much wider diversity of uses than can be found on today's Internet.