TC: Small: Automatically Identifying Botnet Command and Control Infrastructures

不幸的是，网络犯罪今天已经成为一门生意。与十年前的互联网安全形势相比，今天大多数重大的互联网攻击都旨在获取经济利益。今天，犯罪分子发送垃圾邮件、窃取数据和发起攻击的一种流行而有效的选择是所谓的机器人--一种恶意软件，其目的是破坏和控制互联网上的主机。与其他类型的恶意软件相比，机器人的主要区别特征是，机器人能够建立一个命令和控制（C C）通道。本项目的目标是开发新的技术和工具来检测从受损机器到僵尸网络的C C服务器的恶意连接。关键的见解是，当在很长一段时间内查看大量的网络流和DNS数据时，对良性和恶意地址的连接尝试应该表现出足够的行为差异，以便可以自动区分它们。 该项目的一个关键挑战是识别行为特征，这些特征将允许检测表现出类似僵尸网络行为的连接。识别恶意C C连接并可能阻止和破坏攻击者与其僵尸网络的通信的能力为工业和社会影响提供了丰富的机会。此外，这项研究将通过教育和推广产生广泛的影响。PI将寻求通过顶级出版物和行业联系广泛传播研究成果。

Unfortunately, cyber crime has become a business today. In contrast to the Internet security situation ten years ago, most of the significant Internet attacks today aim to make a financial profit. A popular and effective choice of criminals today for sending spam, stealing data, and launching attacks are so called bots -- a type of malware that is written with the intent of compromising and taking control of hosts on the Internet. The main distinguishing characteristic of a bot compared to other types of malware is that a bot is able to establish a command and control (C&C) channel.The goal of this project is to develop novel techniques and tools to detect malicious connections from compromised machines to the C&C servers of botnets. The key insight is that when looking at very large volumes of netflow and DNS data over an extended period of time, connection attempts to benign and malicious addresses should exhibit enough differences in behavior so that they can be automatically distinguished. A key challenge in this project is to identify behavioral features that will allow the detection of connections that exhibit botnet-like behavior.The ability to identify malicious C&C connections and to potentially block and disrupt the communication of the attackers with their bots presents rich opportunities for industrial and societal impact. Furthermore, the research will have a broad effect though education and outreach. The PI will seek broad dissemination of research results through both top publications and industry connections.