'Fingerprinting' Botnets
To try to bring some organization to competing claims, often contradictory, of which botnets are on the rise and which on the skids, Stewart first "fingerprinted" each botnet. "There are enough differences to the SMTP 'fingerprints' for each botnet that we could separate them pretty accurately," he said.
Individual bots implement the SMTP (Simply Mail Transfer Protocol) with minor variations, Stewart said. By developing network-based signatures, he was able to differentiate the collections.
He also estimated the size of each botnet by taking a one-day spam traffic sample from that bot -- the sample derived from SecureWorks' client base -- and then using probabilistic counting methods, extrapolated to come up with a botnet total. Stewart said that past data collected from control server logs confirmed this estimating technique as "fairly accurate."
The whole idea, he added, was to make it easier for everyone to keep track of the most dangerous botnets. "I hope this lets other researchers classify and track botnets better," said Stewart. "Bobax, for instance, flew under the radar for over two years because of confusion. It was still around, but [anti-virus] vendors stopped recognizing [the malware]."
End users should get something out of his work, too. "I think it matters a lot to end users what a botnet's called. They go to look for information, perhaps after they've been infected, and all they have is that it's 'agentxyz.'" But unless everyone is one the same page, that "agentxyz" may simply be a new alias. "Then they'd find hardly any information on what it is or what data it may be after. They won't have a clear picture.
"I hope this trickles down to end users," Stewart concluded.
For more enterprise computing news, visit Computerworld. Story copyright © 2007 Computerworld Inc. All rights reserved.
- Sponsored Resource:Are you ready for virtualization? Try the sever assessment tool.
- Sponsored Resource:Learn more about ultra light notebooks from Asus and the best warranty in the industry.
- Sponsored Resource:Thinking about a new Laptop? Lenovo has models to meet everyone's needs.
- Sponsored Resource:Get the truth about remanufactured ink. Learn more from HP.
- Sponsored Resource:Six smart ways to grow small business IT
News For Your Business
- Online Encyclopedia Lists Internal Network Security Threats
- Judge Dissolves Gag Order Against MIT Students
- Data Security: What the Law Requires of IT
- Wells Fargo Access Codes Compromise Personal Data
- Internet Fraud Ignored by Authorities, Study Charges
Community Comments