Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks
A large fraction of email spam, distributed denial-of-service (DDoS) attacks, and click-fraud on web advertisements are caused by traffic sent from compromised machines that form botnets. This paper posits that by identifying human-generated traffic as such, one can service it with improved reliabil...
| Main Authors: | , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | en_US |
| Published: |
USENIX Association
2012
|
| Online Access: | http://hdl.handle.net/1721.1/73143 https://orcid.org/0000-0002-1455-9652 |
| _version_ | 1811070385706237952 |
|---|---|
| author | Gummadi, Ramakrishna Balakrishnan, Hari Maniatis, Petros Ratnasamy, Sylvia |
| author2 | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory |
| author_facet | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Gummadi, Ramakrishna Balakrishnan, Hari Maniatis, Petros Ratnasamy, Sylvia |
| author_sort | Gummadi, Ramakrishna |
| collection | MIT |
| description | A large fraction of email spam, distributed denial-of-service (DDoS) attacks, and click-fraud on web advertisements are caused by traffic sent from compromised machines that form botnets. This paper posits that by identifying human-generated traffic as such, one can service it with improved reliability or higher priority, mitigating the effects of botnet attacks.
The key challenge is to identify human-generated traffic in the absence of strong unique identities. We develop NAB (``Not-A-Bot''), a system to approximately identify and certify human-generated activity. NAB uses a small trusted software component called an attester, which runs on the client machine with an untrusted OS and applications. The attester tags each request with an attestation if the request is made within a small amount of time of legitimate keyboard or mouse activity. The remote entity serving the request sends the request and attestation to a verifier, which checks the attestation and implements an application-specific policy for attested requests.
Our implementation of the attester is within the Xen hypervisor. By analyzing traces of keyboard and mouse activity from 328 users at Intel, together with adversarial traces of spam, DDoS, and click-fraud activity, we estimate that NAB reduces the amount of spam that currently passes through a tuned spam filter by more than 92%, while not flagging any legitimate email as spam. NAB delivers similar benefits to legitimate requests under DDoS and click-fraud attacks. |
| first_indexed | 2024-09-23T08:35:08Z |
| format | Article |
| id | mit-1721.1/73143 |
| institution | Massachusetts Institute of Technology |
| language | en_US |
| last_indexed | 2024-09-23T08:35:08Z |
| publishDate | 2012 |
| publisher | USENIX Association |
| record_format | dspace |
| spelling | mit-1721.1/731432022-09-30T09:45:48Z Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks Gummadi, Ramakrishna Balakrishnan, Hari Maniatis, Petros Ratnasamy, Sylvia Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Balakrishnan, Hari Gummadi, Ramakrishna Balakrishnan, Hari A large fraction of email spam, distributed denial-of-service (DDoS) attacks, and click-fraud on web advertisements are caused by traffic sent from compromised machines that form botnets. This paper posits that by identifying human-generated traffic as such, one can service it with improved reliability or higher priority, mitigating the effects of botnet attacks. The key challenge is to identify human-generated traffic in the absence of strong unique identities. We develop NAB (``Not-A-Bot''), a system to approximately identify and certify human-generated activity. NAB uses a small trusted software component called an attester, which runs on the client machine with an untrusted OS and applications. The attester tags each request with an attestation if the request is made within a small amount of time of legitimate keyboard or mouse activity. The remote entity serving the request sends the request and attestation to a verifier, which checks the attestation and implements an application-specific policy for attested requests. Our implementation of the attester is within the Xen hypervisor. By analyzing traces of keyboard and mouse activity from 328 users at Intel, together with adversarial traces of spam, DDoS, and click-fraud activity, we estimate that NAB reduces the amount of spam that currently passes through a tuned spam filter by more than 92%, while not flagging any legitimate email as spam. NAB delivers similar benefits to legitimate requests under DDoS and click-fraud attacks. 2012-09-24T20:52:51Z 2012-09-24T20:52:51Z 2009-04 Article http://purl.org/eprint/type/ConferencePaper http://hdl.handle.net/1721.1/73143 Gummadi, Ramakrishna et al. "Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks." Proceedings of the 6th USENIX Symposium on Networked Systems Design and Implementation, NSDI ’09. April 22-24, 2009, Boston, Mass. p. 307-320. http://static.usenix.org/events/nsdi09/tech/ https://orcid.org/0000-0002-1455-9652 en_US http://static.usenix.org/events/nsdi09/tech/full_papers/gummadi/gummadi.pdf Proceedings of the 6th USENIX Symposium on Networked Systems Design and Implementation, NSDI ’09 Creative Commons Attribution-Noncommercial-Share Alike 3.0 http://creativecommons.org/licenses/by-nc-sa/3.0/ application/pdf USENIX Association Other Repository |
| spellingShingle | Gummadi, Ramakrishna Balakrishnan, Hari Maniatis, Petros Ratnasamy, Sylvia Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks |
| title | Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks |
| title_full | Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks |
| title_fullStr | Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks |
| title_full_unstemmed | Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks |
| title_short | Not-a-Bot (NAB): Improving Service Availability in the Face of Botnet Attacks |
| title_sort | not a bot nab improving service availability in the face of botnet attacks |
| url | http://hdl.handle.net/1721.1/73143 https://orcid.org/0000-0002-1455-9652 |
| work_keys_str_mv | AT gummadiramakrishna notabotnabimprovingserviceavailabilityinthefaceofbotnetattacks AT balakrishnanhari notabotnabimprovingserviceavailabilityinthefaceofbotnetattacks AT maniatispetros notabotnabimprovingserviceavailabilityinthefaceofbotnetattacks AT ratnasamysylvia notabotnabimprovingserviceavailabilityinthefaceofbotnetattacks |