NotesFAQContact Us
Collection
Advanced
Search Tips
ERIC Number: ED530671
Record Type: Non-Journal
Publication Date: 2011
Pages: 117
Abstractor: As Provided
Reference Count: 0
ISBN: ISBN-978-1-1246-9063-6
ISSN: N/A
Advances in Modern Botnet Understanding and the Accurate Enumeration of Infected Hosts
Nunnery, Christopher Edward
ProQuest LLC, Ph.D. Dissertation, The University of North Carolina at Charlotte
Botnets remain a potent threat due to evolving modern architectures, inadequate remediation methods, and inaccurate measurement techniques. In response, this research exposes the architectures and operations of two advanced botnets, techniques to enumerate infected hosts, and pursues the scientific refinement of infected-host enumeration data by recognizing network structures which distort measurement. This effort is motivated by the desire to reveal botnet behavior and trends for future mitigation, methods to discover infected hosts for remediation in real time and threat assessment, and the need to reveal the inaccuracy in population size estimation when only counting IP addresses. Following an explanation of theoretical enumeration techniques, the architectures, deployment methodologies, and malicious output for the Storm and Waledac botnets are presented. Several tools developed to enumerate these botnets are then assessed in terms of performance and yield. Finally, this study documents methods that were developed to discover the boundaries and impact of NAT and DHCP blocks in network populations along with a footprint measurement based on relative entropy which better describes how uniformly infections communicate through their IP addresses. Population data from the Waledac botnet was used to evaluate these techniques. [The dissertation citations contained here are published with the permission of ProQuest LLC. Further reproduction is prohibited without permission. Copies of dissertations may be obtained by Telephone (800) 1-800-521-0600. Web page: http://www.proquest.com/en-US/products/dissertations/individuals.shtml.]
ProQuest LLC. 789 East Eisenhower Parkway, P.O. Box 1346, Ann Arbor, MI 48106. Tel: 800-521-0600; Web site: http://www.proquest.com/en-US/products/dissertations/individuals.shtml
Publication Type: Dissertations/Theses - Doctoral Dissertations
Education Level: N/A
Audience: N/A
Language: English
Sponsor: N/A
Authoring Institution: N/A