[Zurück]

P. Wurzinger, L. Bilge, E. Kirda, C. Krügel, T. Holz, J. Göbel:
"Automatically Generating Models for Botnet Detection";
Vortrag: European Symposium on Research in Computer Security (ESORICS), Saint Malo, Brittany, France; 21.09.2009 - 25.09.2009; in: "14th European Symposium on Research in Computer Security (ESORICS 2009)", (2009).

A botnet is a network of compromised hosts that is under the control of a single, malicious entity, often called the botmaster. We present a system that aims to detect bots, independent of any prior information about the command and control channels or propagation vectors, and without requiring multiple infections for correlation. Our system relies on detection models that target the characteristic fact that every bot receives commands from the botmaster to which it responds in a specific way. These detection models are generated automatically from network traffic traces recorded from actual bot instances. We have implemented the proposed approach and demonstrate that it can extract effective detection models for a variety of different bot families. These models are precise in describing the activity of bots and raise very few false positives.

http://publik.tuwien.ac.at/files/PubDat_180355.pdf

Projektleitung Wolfgang Kastner:
Pathfinder - Malicious Code Analysis and Detection

Projektleitung Paolo Milani Comparetti:
Worldwide Observatory of Malicious Behaviors and Attack Threats