深度-哈佛大学肯尼迪学院-零僵尸网络（互联网机器人）：一种观察、追踪、对抗方法（英文）-2021.5-50页_1mb

Zero Botnets: An Observe-Pursue-Counter Approach

Core Content

This report, Zero Botnets: An Observe-Pursue-Counter Approach, presents a comprehensive strategy for reducing the presence of botnets on the Internet, with the ultimate goal of achieving a "zero botnets" state. The approach is grounded in systems analysis and draws parallels with defense mechanisms in other physical domains (land, sea, air, space). It emphasizes the need for international cooperation, public-private partnerships, and the use of advanced technologies to detect, track, and counter botnet activities.

Main Viewpoints

• Botnets as a Threat: Botnets are a growing threat to Internet security and stability. They are used for adversary reconnaissance, influence operations, and financial crimes, often while masking their operations.
• Need for a Global Effort: The authors argue that achieving a zero botnets goal requires a coordinated global effort. Non-governmental actors alone cannot eliminate botnets, and governments must play a more active role in their takedown.
• Observation as a Key Component: The observe-pursue-counter approach is critical for understanding and responding to botnet threats. Observation involves collecting and analyzing network traffic metadata to identify malicious activity early.
• Technological Feasibility: The report affirms that the technical feasibility of an observe-pursue-counter architecture is high. Advances in AI, data processing, and anonymized traffic analysis have made it possible to monitor large-scale networks effectively.
• Policy and Legal Frameworks: While the report focuses on the technical aspects, it acknowledges the need for clear legal and policy frameworks to address privacy, surveillance, and authority issues in botnet takedowns.

Key Information

• Botnet Definition: A botnet is a network of infected devices under the control of a bot-herder. These networks can consist of millions of nodes and are used to execute various malicious activities.
• Traffic Patterns: Botnets create distinct traffic patterns that can be detected through network observation. These include unusual communication behaviors, centralized command and control structures, and anomalous network activity.
• Anonymized Data: The use of anonymized traffic matrices is a key enabler of the observe-pursue-counter approach. These matrices allow for the detection of subtle anomalies without revealing user identities.
• AI and Network Science: AI algorithms and network science techniques are used to model background traffic, detect anomalies, and classify botnet activities. These methods are increasingly being adopted by both private and public sector entities.
• System Analysis: The report advocates for the use of system analysis to guide the development of a scalable and effective botnet takedown architecture. This includes understanding the technological and policy requirements of each stage.

Structure of the Approach

The observe-pursue-counter approach consists of three main components:

1. Observe: Collect and analyze network traffic data to identify botnet activity and patterns.
2. Pursue: Actively track and engage with botnet components to disrupt their operations.
3. Counter: Implement measures to neutralize botnets, such as sinkholing command and control servers or patching infected devices.

Technological Considerations

• Network Observatories: These are essential for capturing and analyzing traffic patterns. They are placed at strategic ingress/egress points to monitor the most relevant data.
• AI and Machine Learning: These technologies are used to model background traffic and detect anomalies. Supervised learning methods rely on known signatures, while unsupervised methods use statistical models to identify deviations.
• Anonymized Data Processing: The use of anonymized data allows for effective monitoring without compromising user privacy. It enables the development of accurate background models and anomaly detection.
• Scalability: The report highlights that with modern AI and cloud computing capabilities, network-based defense systems can handle large volumes of data and detect botnet activities at scale.

Policy Considerations

• Shared Situational Awareness: The report encourages the development of public-private partnerships that share information and coordinate actions against botnets.
• International Cooperation: A global community is needed to enforce norms of responsible state behavior and support botnet takedown efforts.
• Legal and Authority Issues: The report acknowledges the challenges of defining proper authorities and access for botnet monitoring and takedown, but suggests that these can be addressed through systems analysis.
• Incentives for Improvement: The authors propose creating incentives for improving network security and encouraging the adoption of best practices by both private and public entities.

Conclusion and Next Steps

• Feasibility of Zero Botnets: The report argues that the "zero botnets" vision is achievable through the observe-pursue-counter approach.
• Next Steps: The authors recommend supporting the international botnet takedown community, expanding network observatories, enhancing network science at scale, conducting detailed systems analysis, and developing appropriate policy frameworks.

Summary of Key Figures

• Figure 1: Illustrates the prevalence of botnets and their impact on Internet traffic.
• Figure 2: Provides a framework for understanding security, defense, and deterrence in cyberspace.
• Figure 3: Demonstrates the capabilities of open standards for anonymized traffic matrices.
• Figure 4: Shows how AI can model background traffic and detect anomalies in anonymized data.
• Figure 5: Highlights the power-law distribution of network traffic and its use in background modeling.
• Figure 6: Provides an example of anomaly detection using anonymized traffic matrices.
• Figure 7: Illustrates AI-based anomaly classification for botnet activities.

Appendices

• Appendix A: Discusses the importance of better data sharing for improving Internet security.
• Appendix B: Focuses on the communication of data release requests to support network defense efforts.

This report serves as a foundational document for developing a robust and scalable strategy to combat botnets through a combination of technological innovation, policy development, and international collaboration.