427 Botnet fm qxd

www.syngress.com
178
Chapter 5 • Botnet Detection: Tools and Techniques
427_Botnet_05.qxd 1/9/07 9:59 AM Page 178

---

An excellent resource for honeynet information (and other security 
literature) is the collection of “Know Your Enemy” papers at http://project.
honeynet.org/papers/kye.html.
T
IP
Honeypots feed a number of major information resources:
The Shadowserver Foundation (www.shadowserver.org) has a
range of information collected from “the dark side of the Internet.” 
Research and Education Networking Information Sharing and
Analysis Center (REN-ISAC) supports organizations connected to
higher education and research networks (www.ren-isac.net). 
Spamhaus Project (www.spamhaus.org) is an awesome spam-killing
resource. Distributed Intrusion Detection System (www.dshield.org) is
the data collection facility that feeds the SANS Internet Storm Center.
At www.bleedingthreats.net/fwrules/bleeding-edge-Block-IPs.txt,
there is a list of raw IP addresses for botnet C&Cs (collected by shad-
owserver), spamhaus DROP nets, and the Dshield top attacker
addresses. 
Forensics Techniques 
and Tools for Botnet Detection
Forensics aren’t exactly what they used to be. Originally the adjective 
forensic
was applied to processes relating to the application of scientific methodology
for presentation to a court of law or for judicial review. Strictly, the field of
computer forensics
applies to the recovery of evidence from digital media and is,
along with network forensics, a branch of digital forensics. However, in recent
years the term has been somewhat divorced from the concept of judicial
review.The First Digital Forensic Research Workshop has defined 
digital foren-
sics
as the “use of scientifically derived and proven methods toward the preser-
vation, collection, validation, identification, analysis, interpretation, and
documentation of digital evidence derived from digital sources for the pur-
pose of facilitating or furthering the reconstruction of events found to be
criminal, or helping to anticipate unauthorized actions shown to be disruptive
to planned operations” (Robert Slade,
Dictionary of Information Security
,