Botnet Detection and Mitigation

Botnets have become a lucrative and monetized line of business for criminal organizations. As of late they have been found in a growing number of cases involving cyber-extortion via Distributed Denial-of-Services (DDOS), and mass phishing where their use of encryption and packing schemes keeps them off the radar of traditional discovery heuristics. The sophistication and proliferation of botnets is such that industry and consumers find themselves victim to crimes committed sometimes months too late. The goal of Sonalysts, Inc. team is to create an architecture that allows consumers, industry, and Government to work together to discover and mitigate botnets. The approach first focuses on developing a descriptive ontology that is used to normalize data between disparate data sources, and thus facilitates sharing and automation. The system will combine normalized data from router net flows, botnet signatures from IDS, and captured signatures in honeypots to feed into a number of distributed automated discovery/correlation systems. The research will pursue the development of a scalable architecture that is used to construct a service-based framework of sensors used to capture botnet signatures and pass information to data mining systems used to correlate it using a discovery taxonomy and/or crack encrypted command and control channels.