Measuring botnet populations - Revision history

Eric.freyssinet at 22:13, 30 July 2015

2015-07-30T22:13:44Z

← Older revision		Revision as of 22:13, 30 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Image=Measuring botnet populations.png		\|Image=Measuring botnet populations.png
	\|Botnet=Conficker, Miner.h,		\|Botnet=Conficker, Miner,
	\|Malware=,		\|Malware=,
	\|CCProtocol=,		\|CCProtocol=,

Eric.freyssinet at 21:56, 30 July 2015

2015-07-30T21:56:40Z

← Older revision		Revision as of 21:56, 30 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Image=Measuring botnet populations.png		\|Image=Measuring botnet populations.png
	\|~~Legend~~=		\|Botnet=Conficker, Miner.h,
			\|Malware=,
			\|CCProtocol=,
			\|Year=2012
			\|Date=2012-05-02
			\|Editor=Arbor Sert
			\|Link=https://asert.arbornetworks.com/measuring-botnet-populations/
			\|Author=Jose Nazario,
			\|Abstract=The following is excerpted from a talk I gave at the 2012 APCERT meeting in Bali, Indonesia in March, 2012. The topic was on botnet population measurements, something that we’ve been doing for many years and has grown in importance.

			What do we mean when we talk about measuring botnet populations? We are trying to measure the number of infected devices to figure out how many people are affected, the number of accounts or customers, and the like. Because of the way the Internet is structured, we can only measure the number of infected PCs or IP addresses received in a time period. We then have to use this information to estimate how large the botnet infected population is.

			We count botnet populations for several reasons. First, we want prevalence measurements in order to understand which threats to focus our limited efforts on. We want to understand the prevalence of a botnet by geographic region, for example, to understand to whom we need to reach out. We also want to understand how we should prioritize our efforts, focusing on botnets that will yield a significant impact if they are addressed. Finally, we want to understand the scale of the resources we need to gather as we tackle the botnet. Continuous measurement is vital in order to understand what mechanisms are effective at reducing the botnet’s population. Also, if the numbers ever drop to zero, we can call it a victory. Finally, we also want to understand the size of the possible attacks and any expected financial impact, in order to prepare defenses.
	\|Document=		\|Document=
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	~~\|Link=http://ddos.arbornetworks.com/2012/05/measuring-botnet-populations/~~
	~~\|Author=Jose Nazario,~~
	\|NomRevue=DDoS and Security Reports: The Arbor Networks Security Blog		\|NomRevue=DDoS and Security Reports: The Arbor Networks Security Blog
	~~\|Date=May 2nd, 2012~~
	~~\|Editor=Arbor Sert~~
	~~\|Year=2012~~
	\|ISBN=		\|ISBN=
	\|Page=		\|Page=
	\|Abstract=The following is excerpted from a talk I gave at the 2012 APCERT meeting in Bali, Indonesia in March, 2012. The topic was on botnet population measurements, something that we’ve been doing for many years and has grown in importance.		\|Operation=,
			\|Keyword=,
	What do we mean when we talk about measuring botnet populations? We are trying to measure the number of infected devices to figure out how many people are affected, the number of accounts or customers, and the like. Because of the way the Internet is structured, we can only measure the number of infected PCs or IP addresses received in a time period. We then have to use this information to estimate how large the botnet infected population is.

	We count botnet populations for several reasons. First, we want prevalence measurements in order to understand which threats to focus our limited efforts on. We want to understand the prevalence of a botnet by geographic region, for example, to understand to whom we need to reach out. We also want to understand how we should prioritize our efforts, focusing on botnets that will yield a significant impact if they are addressed. Finally, we want to understand the scale of the resources we need to gather as we tackle the botnet. Continuous measurement is vital in order to understand what mechanisms are effective at reducing the botnet’s population. Also, if the numbers ever drop to zero, we can call it a victory. Finally, we also want to understand the size of the possible attacks and any expected financial impact, in order to prepare defenses.
	~~\|Botnet=Conficker, Miner.h,~~
	~~\|Malware=,~~
	~~\|CCProtocol=,~~
	\|Operation=,
	\|Keyword=,
	}}		}}

Eric.freyssinet: Text replacement - " ddos.arbornetworks.com" to ""

2015-02-08T16:49:29Z

Text replacement - " ddos.arbornetworks.com" to ""

← Older revision		Revision as of 16:49, 8 February 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://ddos.arbornetworks.com/2012/05/measuring-botnet-populations/ ~~ddos.arbornetworks.com~~		\|Link=http://ddos.arbornetworks.com/2012/05/measuring-botnet-populations/
	\|Author=Jose Nazario,		\|Author=Jose Nazario,
	\|NomRevue=DDoS and Security Reports: The Arbor Networks Security Blog		\|NomRevue=DDoS and Security Reports: The Arbor Networks Security Blog

Eric.freyssinet: 1 revision imported

2015-02-07T14:24:30Z

1 revision imported

New page

{{Publication
|Image=Measuring botnet populations.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://ddos.arbornetworks.com/2012/05/measuring-botnet-populations/ ddos.arbornetworks.com
|Author=Jose Nazario,
|NomRevue=DDoS and Security Reports: The Arbor Networks Security Blog
|Date=May 2nd, 2012
|Editor=Arbor Sert
|Year=2012
|ISBN=
|Page=
|Abstract=The following is excerpted from a talk I gave at the 2012 APCERT meeting in Bali, Indonesia in March, 2012. The topic was on botnet population measurements, something that we’ve been doing for many years and has grown in importance.

What do we mean when we talk about measuring botnet populations? We are trying to measure the number of infected devices to figure out how many people are affected, the number of accounts or customers, and the like. Because of the way the Internet is structured, we can only measure the number of infected PCs or IP addresses received in a time period. We then have to use this information to estimate how large the botnet infected population is.

We count botnet populations for several reasons. First, we want prevalence measurements in order to understand which threats to focus our limited efforts on. We want to understand the prevalence of a botnet by geographic region, for example, to understand to whom we need to reach out. We also want to understand how we should prioritize our efforts, focusing on botnets that will yield a significant impact if they are addressed. Finally, we want to understand the scale of the resources we need to gather as we tackle the botnet. Continuous measurement is vital in order to understand what mechanisms are effective at reducing the botnet’s population. Also, if the numbers ever drop to zero, we can call it a victory. Finally, we also want to understand the size of the possible attacks and any expected financial impact, in order to prepare defenses.
|Botnet=Conficker, Miner.h,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}