botnet underground economics

Information about botnet underground economics

Published on December 4, 2007

Author: Jolene

Source: authorstream.com

Content

  Understanding Botnets: How Massive Internet Break-Ins Fuel an Underground Economy:    Understanding Botnets: How Massive Internet Break-Ins Fuel an Underground Economy Jason Franklin and Vern Paxson Abstract:  Abstract We study how the creation of massive networks of compromised machines fuel an underground economy. The underground market being studied is a central point for miscreant activity including identity theft, phishing, sale of compromised machines, and credit card fraud. Through extensive passive monitoring and analysis of this underground marketplace, we hope to establish connections between various facets of illegal online activities. Measurement Methodology:  Measurement Methodology Passive monitoring and archival of Internet Relay Chat (IRC) channels 50+ monitored servers Over 7 months of data Over 12 million individual messages from as many as 50k individuals Limitations and Complexities No private IRC messages Complex underground dialect (slang) Difficult to establish reputation S S S C C C M C IRC Botnet Definition:  Botnet Definition A botnet is a network of compromised machines (bots) remotely controlled by an attacker. Key U ncompromised Host Underground Market Breakdown:  Underground Market Breakdown Observed Relationships and Causality:  Observed Relationships and Causality Stolen Credit cards Market at a Glance:  Market at a Glance Number of Days Monitored Percentage of Monitored Messages Market at a Glance:  Market at a Glance Number of Days Monitored Percentage of Monitored Messages Vulnerability Alerts, Exploits, and Potential Bots:  Vulnerability Alerts, Exploits, and Potential Bots Vertical lines represent releases of major vulnerability alert. Percentage of Monitored Messages Number of Days Monitored Vulnerability Alerts, Exploits, and Potential Bots:  Vulnerability Alerts, Exploits, and Potential Bots Vertical lines represent releases of major vulnerability alert. Percentage of Monitored Messages Number of Days Monitored Complex Social Network:  Complex Social Network Future work includes leveraging social network analysis techniques to map connections between players. Conclusion:  Conclusion Preliminary results show that underground markets aggregate information which is otherwise difficult to observe. Monitoring underground markets may be useful as a predictor of future widespread malicious activities on the Internet. We may be able to use the market as an oracle. Future analysis of the complex relationships between market players is required. Acknowledgements:  Acknowledgements We would like to thank Rob Thomas of team Cymru for providing access to the IRC logs. We would also like to thank Stefan Savage, Robin Sommers, and Nick Weaver for their comments and suggestions. This research was performed while on appointment as a U.S. Department of Homeland Security (DHS) Fellow under the DHS Scholarship and Fellowship Program, a program administered by the Oak Ridge Institute for Science and education (ORISE) for DHS through an interagency agreement with the U.S Department of Energy (DOE). ORISE is managed by Oak Ridge Associated Universities under DOE contract number DE-AC05-00OR22750. All opinions expressed in this paper are the author's and do not necessarily reflect the policies and views of DHS, DOE, or ORISE. The research described here was performed at the Lawrence Berkeley National Laboratory and supported by the Director, Office of Science, Office of Workforce Development for Teachers and Scientists, of the U.S. Department of Energy under Contract No. DE-AC02-05CH11231.

Related presentations


Other presentations created by Jolene

Smart Dust and Micro Robots
07. 01. 2008
0 views

Smart Dust and Micro Robots

2509 9h20 kessler usoinseguro
02. 05. 2008
0 views

2509 9h20 kessler usoinseguro

whats driving emerging markets
27. 09. 2007
0 views

whats driving emerging markets

Barrie Peter Pan Text Only
12. 10. 2007
0 views

Barrie Peter Pan Text Only

rutherford winterjohnson
13. 10. 2007
0 views

rutherford winterjohnson

chap3 2
16. 10. 2007
0 views

chap3 2

IntroDNACloningDNARep
16. 10. 2007
0 views

IntroDNACloningDNARep

MOAC204
17. 10. 2007
0 views

MOAC204

nile hydrology
23. 10. 2007
0 views

nile hydrology

12 HACCPJuiceSeafood French
24. 10. 2007
0 views

12 HACCPJuiceSeafood French

politiques Sant Boi Pere Dorca
24. 10. 2007
0 views

politiques Sant Boi Pere Dorca

thomson
15. 10. 2007
0 views

thomson

climate change and poverty
29. 11. 2007
0 views

climate change and poverty

Macroevolution
12. 10. 2007
0 views

Macroevolution

Roman Religion powerpoint
29. 10. 2007
0 views

Roman Religion powerpoint

2268Atakan
31. 10. 2007
0 views

2268Atakan

Banned Books
31. 10. 2007
0 views

Banned Books

Bob
01. 11. 2007
0 views

Bob

Week 3 DW Design Kimball
07. 11. 2007
0 views

Week 3 DW Design Kimball

STILLEHAVSKRIGEN3
13. 11. 2007
0 views

STILLEHAVSKRIGEN3

enhancing osh standards
14. 11. 2007
0 views

enhancing osh standards

ELISA 2004
12. 10. 2007
0 views

ELISA 2004

Climate McBean f
21. 10. 2007
0 views

Climate McBean f

PP 08 Conditioning
16. 11. 2007
0 views

PP 08 Conditioning

Ontologies in Bioinformatics
20. 11. 2007
0 views

Ontologies in Bioinformatics

laminas centroamÃrica
22. 10. 2007
0 views

laminas centroamÃrica

1World War II
23. 12. 2007
0 views

1World War II

NOAA Fisheries NMFS
28. 12. 2007
0 views

NOAA Fisheries NMFS

ClassDay4
31. 12. 2007
0 views

ClassDay4

ENGR310 1 07
03. 01. 2008
0 views

ENGR310 1 07

PAN Villarreal
22. 10. 2007
0 views

PAN Villarreal

gpr
05. 01. 2008
0 views

gpr

hansen
29. 10. 2007
0 views

hansen

3 El Hattab Ahamed
25. 10. 2007
0 views

3 El Hattab Ahamed

marrocos2
24. 10. 2007
0 views

marrocos2

NWS Partnering
05. 10. 2007
0 views

NWS Partnering

Lyster
16. 10. 2007
0 views

Lyster

webcast1
29. 10. 2007
0 views

webcast1

Chicago
15. 10. 2007
0 views

Chicago

Faridah Noor Indian Dance New
23. 11. 2007
0 views

Faridah Noor Indian Dance New

xmm UG 051606
28. 11. 2007
0 views

xmm UG 051606

ISOM7
15. 10. 2007
0 views

ISOM7

Thermocouple
16. 02. 2008
0 views

Thermocouple

Gubler
21. 10. 2007
0 views

Gubler

test5
30. 10. 2007
0 views

test5

pit 2
26. 02. 2008
0 views

pit 2

m6 Eyler
28. 02. 2008
0 views

m6 Eyler

PSCM
07. 03. 2008
0 views

PSCM

pfl powerpoint may06
10. 03. 2008
0 views

pfl powerpoint may06

Prasa2001
13. 03. 2008
0 views

Prasa2001

PresentationANALYSTE SSNI2006
24. 10. 2007
0 views

PresentationANALYSTE SSNI2006

Perine I2 22april04
16. 03. 2008
0 views

Perine I2 22april04

Panel B Igor Hansen
20. 03. 2008
0 views

Panel B Igor Hansen

kapil kaul
25. 03. 2008
0 views

kapil kaul

part1 intro
07. 10. 2007
0 views

part1 intro

ans1 ffa program
03. 04. 2008
0 views

ans1 ffa program

Jonah
07. 04. 2008
0 views

Jonah

051208 Osawa
09. 10. 2007
0 views

051208 Osawa

3arq
18. 10. 2007
0 views

3arq

Bourgeat Siam
06. 12. 2007
0 views

Bourgeat Siam

allen
08. 04. 2008
0 views

allen

Fry 2005
10. 04. 2008
0 views

Fry 2005

ValueofNonpartisan
14. 04. 2008
0 views

ValueofNonpartisan

lovelock12
16. 04. 2008
0 views

lovelock12

Pumpkin SmallSat 2006
17. 04. 2008
0 views

Pumpkin SmallSat 2006

CSAM DOJ Briefing Day2
22. 04. 2008
0 views

CSAM DOJ Briefing Day2

SOUTHEAST pp
03. 01. 2008
0 views

SOUTHEAST pp

Arbetslagsplan 04 05
02. 11. 2007
0 views

Arbetslagsplan 04 05

dentist
06. 05. 2008
0 views

dentist

critical care slides
07. 05. 2008
0 views

critical care slides

origins
08. 05. 2008
0 views

origins

mas info
08. 05. 2008
0 views

mas info

18 4
22. 10. 2007
0 views

18 4

Vulvodynia
01. 05. 2008
0 views

Vulvodynia

014 Robot Control Architectures
02. 05. 2008
0 views

014 Robot Control Architectures

3678s1 03 schechter
02. 05. 2008
0 views

3678s1 03 schechter

Dana Guerrieri
02. 05. 2008
0 views

Dana Guerrieri

Anestezja
02. 05. 2008
0 views

Anestezja

lezersp1
15. 10. 2007
0 views

lezersp1

20050928 Yasuyuki Fuchita
09. 10. 2007
0 views

20050928 Yasuyuki Fuchita

S Pathi
16. 10. 2007
0 views

S Pathi

Thompson Adjusted
30. 04. 2008
0 views

Thompson Adjusted

Poretti dscut Gdor CW8
15. 11. 2007
0 views

Poretti dscut Gdor CW8

2002 04 maintenance
19. 11. 2007
0 views

2002 04 maintenance

N1 Richard News from ELAN Paris
29. 09. 2007
0 views

N1 Richard News from ELAN Paris

cal20050303
09. 10. 2007
0 views

cal20050303

2007 FL GHC ICC Tezak Kilcollins
05. 10. 2007
0 views

2007 FL GHC ICC Tezak Kilcollins

TUD About the institution
18. 03. 2008
0 views

TUD About the institution

iPOP2007 OIF Berthold
09. 10. 2007
0 views

iPOP2007 OIF Berthold

patricia arsene
15. 10. 2007
0 views

patricia arsene

IHS 2003
27. 03. 2008
0 views

IHS 2003

MOTIVATE 1 slides
29. 10. 2007
0 views

MOTIVATE 1 slides

Alia2003
05. 10. 2007
0 views

Alia2003

RE SUNUM ppt2
23. 11. 2007
0 views

RE SUNUM ppt2

grid2000 welcome
17. 10. 2007
0 views

grid2000 welcome

Larry
07. 01. 2008
0 views

Larry

Abel
25. 10. 2007
0 views

Abel

Weitz Tracy 1 24 07
03. 01. 2008
0 views

Weitz Tracy 1 24 07

del rel
07. 11. 2007
0 views

del rel

ilc analyse
23. 10. 2007
0 views

ilc analyse

CAS 07 MDHS
02. 05. 2008
0 views

CAS 07 MDHS