A multifaceted approach to understanding the botnet phenomenon

摘要: The academic community has long acknowledged the existence of malicious botnets, however to date, very little is known about behavior these distributed computing platforms. To best our knowledge, botnet never been methodically studied, prevalence on Internet mostly a mystery, and life cycle yet be modeled. Uncertainty abounds. In this paper, we attempt clear fog surrounding botnets by constructing multifaceted measurement infrastructure. Throughout period more than three months, used infrastructure track 192 unique IRC size ranging from few hundred several thousand infected end-hosts. Our results show that represent major contributor unwanted traffic - 27% all connection attempts observed darknet can directly attributed botnet-related spreading activity. Furthermore, discovered evidence infections in 11% 800,000 DNS domains examined, indicating high diversity among victims. Taken as whole, not only highlight prominence but also provide deep insights may facilitate further research curtail phenomenon.