Leveraging Controlled Information Sharing for Botnet Activity Detection

Leveraging Controlled Information Sharing for Botnet Activity Detection. Ardi, C. & Heidemann, J. In Proceedings of the ACM SIGCOMM Workshop on Traffic Measurements for Cybersecurity, pages 14–20, Budapest, Hungary, August, 2018. ACM.

Paper doi abstract bibtex

Today's malware often relies on DNS to enable communication with command-and-control (C&C). As defenses that block traffic improve, malware use sophisticated techniques to hide this traffic, including ``fast flux'' names and Domain-Generation Algorithms (DGAs). Detecting this kind of activity requires analysis of DNS queries in network traffic, yet these signals are sparse. As bot countermeasures grow in sophistication, detecting these signals increasingly requires the synthesis of information from multiple sites. Yet \emphsharing security information across organizational boundaries to date has been infrequent and ad hoc because of unknown risks and uncertain benefits. In this paper, we take steps towards formalizing cross-site information sharing and quantifying the benefits of data sharing. We use a case study on DGA-based botnet detection to evaluate how sharing cybersecurity data can improve detection sensitivity and allow the discovery of malicious activity with greater precision.

@InProceedings{Ardi18a,
	author          = "Calvin Ardi and John Heidemann",
	title           = "Leveraging Controlled Information Sharing for Botnet Activity Detection",
	booktitle       = "Proceedings of the " # "{ACM} SIGCOMM Workshop on Traffic Measurements for Cybersecurity",
	year            = 2018,
	sortdate        = "2018-08-19",
	project         = "ant, retrofuturebridge, lacanic",
	jsubject        = "network_observation",
	month           = aug,
	pages           = "14--20",
	address         = "Budapest, Hungary",
	publisher       = "ACM",
	location        = "johnh: pafile",
	keywords        = "retro-future, cross-organization data sharing",
	doi             = "https://doi.org/10.1145/3229598.3229602",
	url             = "https://ant.isi.edu/%7ejohnh/PAPERS/Ardi18a.html",
	pdfurl          = "https://ant.isi.edu/%7ejohnh/PAPERS/Ardi18a.pdf",
	blogurl         = "https://ant.isi.edu/blog/?p=1239",
	authorizeurl    = "https://dl.acm.org/authorize?N666558",
	copyrightholder = "authors",
	myorganization  = "USC/Information Sciences Institute",
	abstract        = "
Today's malware often relies on DNS to enable communication with
command-and-control (C&C). As defenses that block traffic improve, malware use
sophisticated techniques to hide this traffic, including ``fast flux'' names
and Domain-Generation Algorithms (DGAs). Detecting this kind of activity
requires analysis of DNS queries in network traffic, yet these signals are
sparse. As bot countermeasures grow in sophistication, detecting these signals
increasingly requires the synthesis of information from multiple sites. Yet
\emph{sharing security information across organizational boundaries} to date
has been infrequent and ad hoc because of unknown risks and uncertain benefits.
In this paper, we take steps towards formalizing cross-site information sharing
and quantifying the benefits of data sharing. We use a case study on DGA-based
botnet detection to evaluate how sharing cybersecurity data can improve
detection sensitivity and allow the discovery of malicious activity with
greater precision.",
}

Downloads: 0

{"_id":"HqBy944GTL5aHrNLc","bibbaseid":"ardi-heidemann-leveragingcontrolledinformationsharingforbotnetactivitydetection-2018","author_short":["Ardi, C.","Heidemann, J."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","author":[{"firstnames":["Calvin"],"propositions":[],"lastnames":["Ardi"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]}],"title":"Leveraging Controlled Information Sharing for Botnet Activity Detection","booktitle":"Proceedings of the ACM SIGCOMM Workshop on Traffic Measurements for Cybersecurity","year":"2018","sortdate":"2018-08-19","project":"ant, retrofuturebridge, lacanic","jsubject":"network_observation","month":"August","pages":"14–20","address":"Budapest, Hungary","publisher":"ACM","location":"johnh: pafile","keywords":"retro-future, cross-organization data sharing","doi":"https://doi.org/10.1145/3229598.3229602","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi18a.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi18a.pdf","blogurl":"https://ant.isi.edu/blog/?p=1239","authorizeurl":"https://dl.acm.org/authorize?N666558","copyrightholder":"authors","myorganization":"USC/Information Sciences Institute","abstract":"Today's malware often relies on DNS to enable communication with command-and-control (C&C). As defenses that block traffic improve, malware use sophisticated techniques to hide this traffic, including ``fast flux'' names and Domain-Generation Algorithms (DGAs). Detecting this kind of activity requires analysis of DNS queries in network traffic, yet these signals are sparse. As bot countermeasures grow in sophistication, detecting these signals increasingly requires the synthesis of information from multiple sites. Yet \\emphsharing security information across organizational boundaries to date has been infrequent and ad hoc because of unknown risks and uncertain benefits. In this paper, we take steps towards formalizing cross-site information sharing and quantifying the benefits of data sharing. We use a case study on DGA-based botnet detection to evaluate how sharing cybersecurity data can improve detection sensitivity and allow the discovery of malicious activity with greater precision.","bibtex":"@InProceedings{Ardi18a,\n\tauthor = \"Calvin Ardi and John Heidemann\",\n\ttitle = \"Leveraging Controlled Information Sharing for Botnet Activity Detection\",\n\tbooktitle = \"Proceedings of the \" # \"{ACM} SIGCOMM Workshop on Traffic Measurements for Cybersecurity\",\n\tyear = 2018,\n\tsortdate = \"2018-08-19\",\n\tproject = \"ant, retrofuturebridge, lacanic\",\n\tjsubject = \"network_observation\",\n\tmonth = aug,\n\tpages = \"14--20\",\n\taddress = \"Budapest, Hungary\",\n\tpublisher = \"ACM\",\n\tlocation = \"johnh: pafile\",\n\tkeywords = \"retro-future, cross-organization data sharing\",\n\tdoi = \"https://doi.org/10.1145/3229598.3229602\",\n\turl = \"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi18a.html\",\n\tpdfurl = \"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi18a.pdf\",\n\tblogurl = \"https://ant.isi.edu/blog/?p=1239\",\n\tauthorizeurl = \"https://dl.acm.org/authorize?N666558\",\n\tcopyrightholder = \"authors\",\n\tmyorganization = \"USC/Information Sciences Institute\",\n\tabstract = \"\nToday's malware often relies on DNS to enable communication with\ncommand-and-control (C&C). As defenses that block traffic improve, malware use\nsophisticated techniques to hide this traffic, including ``fast flux'' names\nand Domain-Generation Algorithms (DGAs). Detecting this kind of activity\nrequires analysis of DNS queries in network traffic, yet these signals are\nsparse. As bot countermeasures grow in sophistication, detecting these signals\nincreasingly requires the synthesis of information from multiple sites. Yet\n\\emph{sharing security information across organizational boundaries} to date\nhas been infrequent and ad hoc because of unknown risks and uncertain benefits.\nIn this paper, we take steps towards formalizing cross-site information sharing\nand quantifying the benefits of data sharing. We use a case study on DGA-based\nbotnet detection to evaluate how sharing cybersecurity data can improve\ndetection sensitivity and allow the discovery of malicious activity with\ngreater precision.\",\n}\n\n","author_short":["Ardi, C.","Heidemann, J."],"bibbaseid":"ardi-heidemann-leveragingcontrolledinformationsharingforbotnetactivitydetection-2018","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Ardi18a.html"},"keyword":["retro-future","cross-organization data sharing"],"metadata":{"authorlinks":{}}},"bibtype":"inproceedings","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["YLyu3mj3xsBeoqiHK","sz46kuqqKmGQiNuh4","fLZcDgNSoSuatv6aX","tAs2bxgkkLZB7xfoZ","fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["retro-future","cross-organization data sharing"],"search_terms":["leveraging","controlled","information","sharing","botnet","activity","detection","ardi","heidemann"],"title":"Leveraging Controlled Information Sharing for Botnet Activity Detection","year":2018}