The Heisenbot Uncertainty Problem: Challenges in Separating Bots from Chaff

In this paper we highlight a number of challenges that arise in using crawling to measure the size, topology, and dynamism of distributed botnets. These challenges include traffic due to unrelated applications, address aliasing, and other active participants on the network such as poisoners. Based upon experience developing a crawler for the Storm botnet, we describe each of the issues we encountered in practice, our approach for managing the underlying ambiguity, and the kind of errors we believe it introduces into our estimates.

• Type: Conference
• Year: 2008
• Where: NSDI
• Authors: Chris Kanich, Kirill Levchenko, Brandon Enright, Geoffrey M. Voelker, Stefan Savage
• Keywords: Active Participants, Challenges Include Traffic, Computer Networks, NSDI 2008, Unrelated Applications