Booter blacklist: Unveiling DDoS-for-hire websites

Jose Jair Santanna; Ricardo De O. Schmidt; Daphne Tuncer; Joey De Vries; Lisandro Z. Granville; Aiko Pras

doi:10.1109/CNSM.2016.7818410

Booter blacklist: Unveiling DDoS-for-hire websites

Jose Jair Santanna, Ricardo De O. Schmidt, Daphne Tuncer, Joey De Vries, Lisandro Z. Granville, Aiko Pras

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

10 Citations (Scopus)

Abstract

The expansion of Distributed Denial of Service (DDoS) for hire websites, known as Booters, has radically modified both the scope and stakes of DDoS attacks. Until recently, however, Booters have only received little attention from the research community. Given their impact, addressing the challenges associated with this phenomenon is crucial. In this paper, we present a rigorous methodology to identify a comprehensive set of existing Booters in the Internet. The methodology relies on well-defined mechanisms to generate a Booter blacklist, from crawling suspect URLs to characterizing and classifying the collected URLs. The list obtained using the methodology presented in this paper has a classification accuracy of 95.5%, which is 10.5% better compared to previous work. We also demonstrate the usage of our methodology applied by the Dutch NREN, SURFNet, which started using our blacklist to extend their Booters' activities monitoring.

Original language	English
Title of host publication	2016 12th International Conference on Network and Service Management, CNSM 2016 and Workshops, 3rd International Workshop on Management of SDN and NFV, ManSDN/NFV 2016, and International Workshop on Green ICT and Smart Networking, GISN 2016
Editors	Shannon Keith-Marsoun, Carlos Raniery Paula dos Santos, Noura Limam, Mohamed Cheriet, Mohamed Faten Zhani, Olivier Festor
Publisher	IEEE
Pages	144-152
Number of pages	9
ISBN (Electronic)	9783901882852
ISBN (Print)	978-1-5090-3236-5
DOIs	https://doi.org/10.1109/CNSM.2016.7818410
Publication status	Published - 13 Jan 2017
Event	12th international Conference on Network and Service Management, CNSM 2016 - Montreal, Canada Duration: 31 Oct 2016 → 4 Nov 2016 Conference number: 12 http://www.cnsm-conf.org/2016/

Conference

Conference	12th international Conference on Network and Service Management, CNSM 2016
Abbreviated title	CNSM 2016
Country/Territory	Canada
City	Montreal
Period	31/10/16 → 4/11/16
Internet address	http://www.cnsm-conf.org/2016/

Access to Document

10.1109/CNSM.2016.7818410

Cite this

Santanna, J. J., Schmidt, R. D. O., Tuncer, D., De Vries, J., Granville, L. Z., & Pras, A. (2017). Booter blacklist: Unveiling DDoS-for-hire websites. In S. Keith-Marsoun, C. R. P. dos Santos, N. Limam, M. Cheriet, M. F. Zhani, & O. Festor (Eds.), 2016 12th International Conference on Network and Service Management, CNSM 2016 and Workshops, 3rd International Workshop on Management of SDN and NFV, ManSDN/NFV 2016, and International Workshop on Green ICT and Smart Networking, GISN 2016 (pp. 144-152). [7818410] IEEE. https://doi.org/10.1109/CNSM.2016.7818410

Santanna, Jose Jair ; Schmidt, Ricardo De O. ; Tuncer, Daphne et al. / Booter blacklist : Unveiling DDoS-for-hire websites. 2016 12th International Conference on Network and Service Management, CNSM 2016 and Workshops, 3rd International Workshop on Management of SDN and NFV, ManSDN/NFV 2016, and International Workshop on Green ICT and Smart Networking, GISN 2016. editor / Shannon Keith-Marsoun ; Carlos Raniery Paula dos Santos ; Noura Limam ; Mohamed Cheriet ; Mohamed Faten Zhani ; Olivier Festor. IEEE, 2017. pp. 144-152

@inproceedings{ee7509c628304cfbba7a6604201b4826,

title = "Booter blacklist: Unveiling DDoS-for-hire websites",

abstract = "The expansion of Distributed Denial of Service (DDoS) for hire websites, known as Booters, has radically modified both the scope and stakes of DDoS attacks. Until recently, however, Booters have only received little attention from the research community. Given their impact, addressing the challenges associated with this phenomenon is crucial. In this paper, we present a rigorous methodology to identify a comprehensive set of existing Booters in the Internet. The methodology relies on well-defined mechanisms to generate a Booter blacklist, from crawling suspect URLs to characterizing and classifying the collected URLs. The list obtained using the methodology presented in this paper has a classification accuracy of 95.5%, which is 10.5% better compared to previous work. We also demonstrate the usage of our methodology applied by the Dutch NREN, SURFNet, which started using our blacklist to extend their Booters' activities monitoring.",

author = "Santanna, {Jose Jair} and Schmidt, {Ricardo De O.} and Daphne Tuncer and {De Vries}, Joey and Granville, {Lisandro Z.} and Aiko Pras",

year = "2017",

month = jan,

day = "13",

doi = "10.1109/CNSM.2016.7818410",

language = "English",

isbn = "978-1-5090-3236-5",

pages = "144--152",

editor = "Shannon Keith-Marsoun and {dos Santos}, {Carlos Raniery Paula} and Noura Limam and Mohamed Cheriet and Zhani, {Mohamed Faten} and Olivier Festor",

booktitle = "2016 12th International Conference on Network and Service Management, CNSM 2016 and Workshops, 3rd International Workshop on Management of SDN and NFV, ManSDN/NFV 2016, and International Workshop on Green ICT and Smart Networking, GISN 2016",

publisher = "IEEE",

note = "12th international Conference on Network and Service Management, CNSM 2016, CNSM 2016 ; Conference date: 31-10-2016 Through 04-11-2016",

url = "http://www.cnsm-conf.org/2016/",

}

Santanna, JJ, Schmidt, RDO, Tuncer, D, De Vries, J, Granville, LZ & Pras, A 2017, Booter blacklist: Unveiling DDoS-for-hire websites. in S Keith-Marsoun, CRP dos Santos, N Limam, M Cheriet, MF Zhani & O Festor (eds), 2016 12th International Conference on Network and Service Management, CNSM 2016 and Workshops, 3rd International Workshop on Management of SDN and NFV, ManSDN/NFV 2016, and International Workshop on Green ICT and Smart Networking, GISN 2016., 7818410, IEEE, pp. 144-152, 12th international Conference on Network and Service Management, CNSM 2016, Montreal, Quebec, Canada, 31/10/16. https://doi.org/10.1109/CNSM.2016.7818410

Booter blacklist : Unveiling DDoS-for-hire websites. / Santanna, Jose Jair; Schmidt, Ricardo De O.; Tuncer, Daphne et al.

2016 12th International Conference on Network and Service Management, CNSM 2016 and Workshops, 3rd International Workshop on Management of SDN and NFV, ManSDN/NFV 2016, and International Workshop on Green ICT and Smart Networking, GISN 2016. ed. / Shannon Keith-Marsoun; Carlos Raniery Paula dos Santos; Noura Limam; Mohamed Cheriet; Mohamed Faten Zhani; Olivier Festor. IEEE, 2017. p. 144-152 7818410.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Booter blacklist

T2 - 12th international Conference on Network and Service Management, CNSM 2016

AU - Santanna, Jose Jair

AU - Schmidt, Ricardo De O.

AU - Tuncer, Daphne

AU - De Vries, Joey

AU - Granville, Lisandro Z.

AU - Pras, Aiko

N1 - Conference code: 12

PY - 2017/1/13

Y1 - 2017/1/13

N2 - The expansion of Distributed Denial of Service (DDoS) for hire websites, known as Booters, has radically modified both the scope and stakes of DDoS attacks. Until recently, however, Booters have only received little attention from the research community. Given their impact, addressing the challenges associated with this phenomenon is crucial. In this paper, we present a rigorous methodology to identify a comprehensive set of existing Booters in the Internet. The methodology relies on well-defined mechanisms to generate a Booter blacklist, from crawling suspect URLs to characterizing and classifying the collected URLs. The list obtained using the methodology presented in this paper has a classification accuracy of 95.5%, which is 10.5% better compared to previous work. We also demonstrate the usage of our methodology applied by the Dutch NREN, SURFNet, which started using our blacklist to extend their Booters' activities monitoring.

AB - The expansion of Distributed Denial of Service (DDoS) for hire websites, known as Booters, has radically modified both the scope and stakes of DDoS attacks. Until recently, however, Booters have only received little attention from the research community. Given their impact, addressing the challenges associated with this phenomenon is crucial. In this paper, we present a rigorous methodology to identify a comprehensive set of existing Booters in the Internet. The methodology relies on well-defined mechanisms to generate a Booter blacklist, from crawling suspect URLs to characterizing and classifying the collected URLs. The list obtained using the methodology presented in this paper has a classification accuracy of 95.5%, which is 10.5% better compared to previous work. We also demonstrate the usage of our methodology applied by the Dutch NREN, SURFNet, which started using our blacklist to extend their Booters' activities monitoring.

UR - http://www.scopus.com/inward/record.url?scp=85013636284&partnerID=8YFLogxK

U2 - 10.1109/CNSM.2016.7818410

DO - 10.1109/CNSM.2016.7818410

M3 - Conference contribution

AN - SCOPUS:85013636284

SN - 978-1-5090-3236-5

SP - 144

EP - 152

BT - 2016 12th International Conference on Network and Service Management, CNSM 2016 and Workshops, 3rd International Workshop on Management of SDN and NFV, ManSDN/NFV 2016, and International Workshop on Green ICT and Smart Networking, GISN 2016

A2 - Keith-Marsoun, Shannon

A2 - dos Santos, Carlos Raniery Paula

A2 - Limam, Noura

A2 - Cheriet, Mohamed

A2 - Zhani, Mohamed Faten

A2 - Festor, Olivier

PB - IEEE

Y2 - 31 October 2016 through 4 November 2016

ER -

Santanna JJ, Schmidt RDO, Tuncer D, De Vries J, Granville LZ, Pras A. Booter blacklist: Unveiling DDoS-for-hire websites. In Keith-Marsoun S, dos Santos CRP, Limam N, Cheriet M, Zhani MF, Festor O, editors, 2016 12th International Conference on Network and Service Management, CNSM 2016 and Workshops, 3rd International Workshop on Management of SDN and NFV, ManSDN/NFV 2016, and International Workshop on Green ICT and Smart Networking, GISN 2016. IEEE. 2017. p. 144-152. 7818410 doi: 10.1109/CNSM.2016.7818410

Booter blacklist: Unveiling DDoS-for-hire websites

Abstract

Conference

Access to Document

Other files and links

Fingerprint

Cite this