427 Botnet fm qxd

www.syngress.com
Botnet Detection: Tools and Techniques • Chapter 5
177
427_Botnet_05.qxd 1/9/07 9:59 AM Page 177

---

if random and accidental traffic (background noise) and, to be useful,
between different kinds (and sources) of traffic on the same service.
Otherwise, you are in the same position as an operator who notices a
spike in traffic on a given port but is unable to distinguish between
flows, let alone “good” and “bad” traffic.
■
Without this discrimination, you are unable to characterize emerging
threats.
■
Perhaps the most valuable objective, though, is to provide insight into
Internet threats that transcend immediate geographical or operational
boundaries.
More information on IMS can be found at www.eecs.umich.edu/
~emcooke/pubs/ims-ndss05.pdf.
You might regard darknets as not dissimilar to a low-interaction honeypot.
A honeypot is a decoy system set up to attract attackers to learn more about
their methods and capabilities. Lance Spitzner quotes the definition “an infor-
mation system resource whose value lies in unauthorized or illicit use of that
resource” (www.newsforge.com/article.pl?sid=04/09/24/1734245). A darknet
doesn’t quite meet this description in that it doesn’t advertise its presence. A
low-interaction honeypot, however, emulates some network services without
exposing the honeypot machine to much in the way of exploitation. Because
it doesn’t interact, it might not capture the same volume of information as a
high-interaction honeypot, which is open to partial or complete compromise.
Honeyd, by Nils Provos, is an example of a low-interaction honeypot that
can present as a network of systems running a range of different services;
mwcollect and nepenthes simulate an exploitable system and are used to col-
lect malware samples.
A honeynet is usually defined as consisting of a number of high-interac-
tion honeypots in a network, offering the attacker real systems, applications,
and services to work on and monitored transparently by a Layer 2 bridging
device called a 
honeywall
. A static honeynet can quickly be spotted and black-
listed by attackers, but distributed honeynets not only attempt to address that
issue—they are likely to capture richer, more varied data.