In this paper, we propose a method to identify and group together traces left on low interaction honeypots by machines belonging to the same botnet(s) without having any a priori information at our disposal regarding these botnets. In other words, we offer a solution to detect new botnets thanks to very cheap and easily deployable solutions. The approach is validated thanks to several months of data collected with the worldwide distributed Leurré.com system. To distinguish the relevant traces from the other ones, we group them according to either the platforms, i.e. targets hit or the countries of origin of the attackers. We show that the choice of one of these two observation viewpoints dramatically influences the results obtained. Each one reveals unique botnets. We explain why. Last but not the least, we show that these botnets remain active during very long periods of times, up to 700 days, even if the traces they left are only visible from time to time.
Honeypot trace forensics : The observation viewpoint matters
"Future Generation Computer Systems", Vol 27, N°5, May 2011, ISSN: 0167-739X
© Elsevier. Personal use of this material is permitted. The definitive version of this paper was published in "Future Generation Computer Systems", Vol 27, N°5, May 2011, ISSN: 0167-739X and is available at : http://dx.doi.org/10.1016/j.future.2010.06.004
PERMALINK : https://www.eurecom.fr/publication/3201