Hello,

We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

A View from Robert Lemos

Hunting Down Botnets

Data mining helps security researchers spot Internet addresses linked to compromised computers.

  • July 30, 2009

To fight malicious attackers on the Internet, it’s important to quickly identify the Internet addresses from which they are operating and to communicate that information to others.

To do that, the Internet Systems Consortium (ISC)–the nonprofit organization that maintains the most popular software for running domain-name servers–collects and analyzes more than 20,000 records per second and stores the results in a massive database, members of the group told attendees at the Black Hat security conference on Wednesday.

“We want to find the badness either before the victims are affected or as the victims are being attacked,” said Andrew Fried, a security researcher with the ISC.

The organization–which runs one of the 13 Internet root-name servers (the F-root)–combines its feed of new domain registrations and changes with reputable blacklists of known bad Internet addresses. In addition, the group searches for domains pointing to multiple IP addresses with low time-to-live intervals (indicating frequent updates to the name server), and addresses that are geographically dispersed. By scoring the results and applying a threshold, the ISC can find Internet addresses that likely host malicious machines.

The analysis technique has helped the ISC and other researchers track the spread of the malicious program Conficker. While Conficker.C–the most prolific variant–has steadily become less prevalent since late March, more than 5 million IP addresses still exhibit signs of infection, Fried said.

According to Chris Lee, a member of the Shadowserver Foundation, China continues to have the lion’s share of computers infected with Conficker, with Russia and Brazil holding second and third place. “This tells us that we are not getting the word out in China [and Russia and Brazil],” said Lee, who also works with the ISC.

The group has also seen signs of Conficker’s peer-to-peer traffic drop off as well.

Couldn't make it to EmTech Next to meet experts in AI, Robotics and the Economy?

Go behind the scenes and check out our video
Want more award-winning journalism? Subscribe and become an Insider.
  • Insider Plus {! insider.prices.plus !}* Best Value

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus the digital magazine, extensive archive, ad-free web experience, and discounts to partner offerings and MIT Technology Review events.

    See details+

    Print + Digital Magazine (6 bi-monthly issues)

    Unlimited online access including all articles, multimedia, and more

    The Download newsletter with top tech stories delivered daily to your inbox

    Technology Review PDF magazine archive, including articles, images, and covers dating back to 1899

    10% Discount to MIT Technology Review events and MIT Press

    Ad-free website experience

  • Insider Basic {! insider.prices.basic !}*

    {! insider.display.menuOptionsLabel !}

    Six issues of our award winning print magazine, unlimited online access plus The Download with the top tech stories delivered daily to your inbox.

    See details+

    Print Magazine (6 bi-monthly issues)

    Unlimited online access including all articles, multimedia, and more

    The Download newsletter with top tech stories delivered daily to your inbox

  • Insider Online Only {! insider.prices.online !}*

    {! insider.display.menuOptionsLabel !}

    Unlimited online access including articles and video, plus The Download with the top tech stories delivered daily to your inbox.

    See details+

    Unlimited online access including all articles, multimedia, and more

    The Download newsletter with top tech stories delivered daily to your inbox

/3
You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.