Towards Situational Awareness of Large-Scale Botnet Probing Events

Botnets dominate today’s attack landscape. Inthis work, we investigate ways to analyze collections of maliciousprobing traffic in order to understand the significance oflarge-scale “botnet probes.” In such events, an entire collectionof remote hosts together probes the address space monitoredby a sensor in some sort of coordinated fashion. Our goal is todevelop methodologies by which sites receiving such probes caninfer—using purely local observation—information about theprobing activity: What scanning strategies does the probing employ?Is this an attack that specifically targets the site, or is the siteonly incidentally probed as part of a larger, indiscriminant attack?Our analysis draws upon extensive honeynet data to explore theprevalence of different types of scanning, including properties,such as trend, uniformity, coordination, and darknet avoidance. Inaddition, we design schemes to extrapolate the global properties ofscanning events (e.g., total population and target scope) as inferredfrom the limited local view of a honeynet. Cross-validating withdata from DShield shows that our inferences exhibit promisingaccuracy.Index Terms—Botnet, computer network security, global propertyextrapolation, honeynet, scan strategy inference, site securitymonitoring, situational awareness, statistical inference.

Z. Li, A. Goyal, Y. Chen, and V. Paxson

Article in journal or magazine