Botnet Mapping Based on Intersections of Traces

Volumetric attacks are a growing concern for current Internet services. These attacks overwhelm Internet services with requests that prevent legitimate users from accessing the service or dramatically increase operational costs. While bot networks account for most volumetric attacks, the current approaches focus on mitigating a single attack. Our work argues that botnets create distinct patterns that can be detected by analyzing multiple traces from previous attacks. We formalize this idea into concrete bot network mapping algorithms and demonstrate their effectiveness in diverse conditions. Such a mapping implies that mitigation of future attacks is considerably easier, threatening the business model behind bot networks.