FIRE: FInding Rogue nEtworks

For many years, online criminals have been able to conduct their illicit activities by masquerading behind disreputable Internet Service Providers (ISPs). For example, organizations such as the Russian Business Network (RBN), Atrivo (a.k.a., Intercage), McColo, and most recently, the Triple Fiber Network (3FN) operated with impunity, providing a safe haven for Internet criminals for their own financial gain. What primarily sets these ISPs apart from others is the significant longevity of the malicious activities on their networks and the apparent lack of action taken in response to abuse reports. Interestingly, even though the Internet provides a certain degree of anonymity, such ISPs fear public attention. Once exposed, rogue networks often cease their malicious activities quickly, or are de-peered (disconnected) by their upstream providers. As a result, the Internet criminals are forced to relocate their operations. In this paper, we present FIRE, a novel system to identify and ex...

• Type: Conference
• Year: 2009
• Where: ACSAC
• Authors: Brett Stone-Gross, Christopher Kruegel, Kevin C. Almeroth, Andreas Moser, Engin Kirda
• Keywords: ACSAC 2009, Internet Criminals, Malicious Activities, Malicious Activity, Security Privacy