Measuring botnet populations

(Publication) Google search: [1]

Measuring botnet populations
Botnet	Conficker, Miner
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2012 / 2012-05-02
Editor/Conference	Arbor Sert
Link	https://asert.arbornetworks.com/measuring-botnet-populations/ (Archive copy)
Author	Jose Nazario
Type

Abstract

“ The following is excerpted from a talk I gave at the 2012 APCERT meeting in Bali, Indonesia in March, 2012. The topic was on botnet population measurements, something that we’ve been doing for many years and has grown in importance.

What do we mean when we talk about measuring botnet populations? We are trying to measure the number of infected devices to figure out how many people are affected, the number of accounts or customers, and the like. Because of the way the Internet is structured, we can only measure the number of infected PCs or IP addresses received in a time period. We then have to use this information to estimate how large the botnet infected population is.

We count botnet populations for several reasons. First, we want prevalence measurements in order to understand which threats to focus our limited efforts on. We want to understand the prevalence of a botnet by geographic region, for example, to understand to whom we need to reach out. We also want to understand how we should prioritize our efforts, focusing on botnets that will yield a significant impact if they are addressed. Finally, we want to understand the scale of the resources we need to gather as we tackle the botnet. Continuous measurement is vital in order to understand what mechanisms are effective at reducing the botnet’s population. Also, if the numbers ever drop to zero, we can call it a victory. Finally, we also want to understand the size of the possible attacks and any expected financial impact, in order to prepare defenses.

Bibtex

 @misc{2012BFR1000,
   editor = {Arbor Sert},
   author = {Jose Nazario},
   title = {Measuring botnet populations},
   date = {02},
   month = May,
   year = {2012},
   howpublished = {\url{https://asert.arbornetworks.com/measuring-botnet-populations/}},
 }