The Automatic Discovery, Identification and Measurement of Botnets

Abstract

The majority of virus, spam and malicious emails are sent through the use of a network of compromised computers, or botnet. The early discovery and identification of the botnet is an important aspect in the understanding of, and the development of responses to new threats aimed at email systems and their users. In this paper we present a novel technique for the automatic identification, analysis and measurement of botnets used to deliver malicious email. The paper also describes a reference implementation of a system developed to demonstrate these techniques. This system has been deployed in a live environment, and has shown to be highly effective in use. Practical applications for the use of the techniques developed, include improved anti-spam and anti-virus systems, are presented.