Toasting the Toasters: Tracking Botnets Using Machine Learning and Automated Verification

No ratings

Presented at BSidesDenver 2017 by

Jeffrey Bickford

Tom Boatwright

Most state of the art botnet tracking techniques today rely on the use of honeypots, malware analysis, and Internet-wide scanning to detect botnets and malware infections. Though these approaches work, malware authors continuously find ways to avoid detection. In this talk, we will discuss the approach Level 3 Threat Research Labs uses to track botnets which takes advantage of something they cannot avoid: their own network communication. As a case study of this approach, we will describe how recent DDoS botnets have wreaked havoc across the Internet and how we observed the highly popular botnet family Mirai evolve over time. We will also share some interesting observations about the actors running these types of botnets.