主 题：Understanding and Detecting BulletProof Hosting on Legitimate Service Provider Networks
演讲人：Sumayah Alrwais,Assistant Professor,King Saud University, Riyadh, SA
时 间：2018年1月12日（周五）10:00-12:00
地 点：清华大学信息技术大楼（FIT） 3-225
内容摘要：
BulletProof Hosting (BPH) services provide criminal actors with technical infrastructure that is resilient to complaints of illicit activities, which serves as a basic building block for streamlining numerous types of attacks. Anecdotal reports have highlighted an emerging trend of these BPH services reselling infrastructure from lower end service providers (hosting ISPs, cloud hosting, and CDNs) instead of from monolithic BPH providers. This has rendered many of the prior methods of detecting BPH less effective, since instead of the infrastructure being highly concentrated within a few malicious Autonomous Systems (ASes) it is now agile and dispersed across a larger set of providers that have a mixture of benign and malicious clients. In this paper, we present the first systematic study on this new trend of BPH services. By collecting and analyzing a large amount of data (25 Whois snapshots of the entire IPv4 address space, 1.5 TB of passive DNS data, and longitudinal data from several blacklist feeds), we are able to identify a set of new features that uniquely characterizes BPH on sub-allocations and are costly to evade. Based upon these features,we train a classifier for detecting malicious sub-allocated network blocks, achieving a 98% recall and 1.5% false discovery rates according to our evaluation. Using a conservatively trained version of our classifier, we scan the whole IPv4 address space and detect 39K malicious network blocks. This allows us to perform a large-scale study of the BPH service ecosystem, which sheds light on this underground business strategy, including patterns of network blocks being recycled and malicious clients migrating to different network blocks, in an effort to evade IP address based blacklisting. Our study highlights the trend of agile BPH services and points to potential methods of detecting and mitigating this emerging threat.
演讲者简介：
Sumayah is an Assistant Professor of King Saud University, Riyadh, SA. She got her PhD degree from Indiana University, USA. She is an active researcher in system security studying and identifying different elements of malicious infrastructure such as malicious domains detection, hosting environments, traffic sources…etc. Sumayah is a published author at popular venues such as IEEE security and privacy and Usenix security and computer and communications security (CCS).Sumayah’s publication:https://scholar.google.com/citations?user=vufWHV8AAAAJ&hl=en
