Advances in Modern Botnet Understanding and the Accurate Enumeration of Infected Hosts

1 online resource (116 pages) : PDF

2011

University of North Carolina at Charlotte

Botnets remain a potent threat due to evolving modern architectures, inadequate remediation methods, and inaccurate measurement techniques. In response, this research exposes the architectures and operations of two advanced botnets, techniques to enumerate infected hosts, and pursues the scientific refinement of infected-host enumeration data by recognizing network structures which distort measurement. This effort is motivated by the desire to reveal botnet behavior and trends for future mitigation, methods to discover infected hosts for remediation in real time and threat assessment, and the need to reveal the inaccuracy in population size estimation when only counting IP addresses. Following an explanation of theoretical enumeration techniques, the architectures, deployment methodologies, and malicious output for the Storm and Waledac botnets are presented. Several tools developed to enumerate these botnets are then assessed in terms of performance and yield. Finally, this study documents methods that were developed to discover the boundaries and impact of NAT and DHCP blocks in network populations along with a footprint measurement based on relative entropy which better describes how uniformly infections communicate through their IP addresses. Population data from the Waledac botnet was used to evaluate these techniques.

doctoral dissertations

Information technology
Information science

Ph.D.

Botnet
Enumeration

Information Technology

Kang, Brent ByungHoon

Chu, Bei-Tseng
Shehab, Mohamed
Shin, Min

Thesis (Ph.D.)--University of North Carolina at Charlotte, 2011.

This Item is protected by copyright and/or related rights. You are free to use this Item in any way that is permitted by the copyright and related rights legislation that applies to your use. For other uses you need to obtain permission from the rights-holder(s). For additional information, see http://rightsstatements.org/page/InC/1.0/.

Copyright is held by the author unless otherwise indicated.

Nunnery_uncc_0694D_10180

http://hdl.handle.net/20.500.13093/etd:1662