Studying spamming botnets using Botlab

TLDR

The authors introduce Botlab, a platform designed to continuously monitor and analyze spam‑oriented botnets and to provide defensive tools that enhance spam filtering and protect users from malicious web sites. Botlab aggregates real‑time data from multiple perspectives—including campus spam arrivals, outgoing spam from captive nodes, and DNS‑derived URLs—integrates and analyzes these streams to deliver accurate, timely, and comprehensive insights into botnet behavior while addressing challenges such as preventing node harm and evading virtual‑machine detection. A measurement study using Botlab shows that six botnets account for 79 % of spam messages received at the University of Washington campus.

Abstract

In this paper we present Botlab, a platform that continually monitors and analyzes the behavior of spam-oriented botnets. Botlab gathers multiple real-time streams of information about botnets taken from distinct perspectives. By combining and analyzing these streams, Botlab can produce accurate, timely, and comprehensive data about spam botnet behavior. Our prototype system integrates information about spam arriving at the University of Washington, outgoing spam generated by captive botnet nodes, and information gleaned from DNS about URLs found within these spam messages. We describe the design and implementation of Botlab, including the challenges we had to overcome, such as preventing captive nodes from causing harm or thwarting virtual machine detection. Next, we present the results of a detailed measurement study of the behavior of the most active spam botnets. We find that six botnets are responsible for 79% of spam messages arriving at the UW campus. Finally, we present defensive tools that take advantage of the Botlab platform to improve spam filtering and protect users from harmful web sites advertised within botnet-generated spam.