Booter list generation: The basis for investigating DDoS-for-hire websites

José Jair Santanna (Corresponding Author), Joey de Vries, Ricardo de O. Schmidt, Daphne Tuncer, Lisandro Z. Granville, Aiko Pras

Research output: Contribution to journalSpecial issueAcademicpeer-review

1 Citation (Scopus)
5 Downloads (Pure)

Abstract

The expansion of Distributed Denial of Service (DDoS)–for-hire websites, known as Booters, has radically modified both the scope and stakes of DDoS attacks. Until recently, however, Booters have only received little attention from the research community. Given their impact, addressing the challenges associated with this phenomenon is crucial. In this paper, we present a rigorous methodology to identify a comprehensive set of existing Booters in the Internet. Before presenting our methodology, we illustrate the benefits of a set of booters on monitoring users from the Dutch NREN, SURFNet, from 2015 to 2017. Our methodology relies on well-defined mechanisms to generate a Booter list, from crawling suspect URLs to characterizing and classifying the collected URLs. The list obtained using the methodology presented in this paper has a classification accuracy of 95.5%, which is 10.5% better compared to previous work.

Original languageEnglish
Article numbere2008
JournalInternational journal of network management
Volume28
Issue number1
Early online date6 Nov 2017
DOIs
Publication statusPublished - 1 Jan 2018

Fingerprint

Websites
Internet
Monitoring
Denial-of-service attack

Cite this

Santanna, José Jair ; de Vries, Joey ; de O. Schmidt, Ricardo ; Tuncer, Daphne ; Z. Granville, Lisandro ; Pras, Aiko. / Booter list generation : The basis for investigating DDoS-for-hire websites. In: International journal of network management. 2018 ; Vol. 28, No. 1.
@article{4322426a85844397b9afb84e7690fb10,
title = "Booter list generation: The basis for investigating DDoS-for-hire websites",
abstract = "The expansion of Distributed Denial of Service (DDoS)–for-hire websites, known as Booters, has radically modified both the scope and stakes of DDoS attacks. Until recently, however, Booters have only received little attention from the research community. Given their impact, addressing the challenges associated with this phenomenon is crucial. In this paper, we present a rigorous methodology to identify a comprehensive set of existing Booters in the Internet. Before presenting our methodology, we illustrate the benefits of a set of booters on monitoring users from the Dutch NREN, SURFNet, from 2015 to 2017. Our methodology relies on well-defined mechanisms to generate a Booter list, from crawling suspect URLs to characterizing and classifying the collected URLs. The list obtained using the methodology presented in this paper has a classification accuracy of 95.5{\%}, which is 10.5{\%} better compared to previous work.",
author = "Santanna, {Jos{\'e} Jair} and Joey de Vries and {de O. Schmidt}, Ricardo and Daphne Tuncer and {Z. Granville}, Lisandro and Aiko Pras",
note = "Special Issue: Security for Emerging Open Networking Technologies",
year = "2018",
month = "1",
day = "1",
doi = "10.1002/nem.2008",
language = "English",
volume = "28",
journal = "International journal of network management",
issn = "1099-1190",
publisher = "Wiley",
number = "1",

}

Booter list generation : The basis for investigating DDoS-for-hire websites. / Santanna, José Jair (Corresponding Author); de Vries, Joey; de O. Schmidt, Ricardo; Tuncer, Daphne; Z. Granville, Lisandro; Pras, Aiko.

In: International journal of network management, Vol. 28, No. 1, e2008, 01.01.2018.

Research output: Contribution to journalSpecial issueAcademicpeer-review

TY - JOUR

T1 - Booter list generation

T2 - The basis for investigating DDoS-for-hire websites

AU - Santanna, José Jair

AU - de Vries, Joey

AU - de O. Schmidt, Ricardo

AU - Tuncer, Daphne

AU - Z. Granville, Lisandro

AU - Pras, Aiko

N1 - Special Issue: Security for Emerging Open Networking Technologies

PY - 2018/1/1

Y1 - 2018/1/1

N2 - The expansion of Distributed Denial of Service (DDoS)–for-hire websites, known as Booters, has radically modified both the scope and stakes of DDoS attacks. Until recently, however, Booters have only received little attention from the research community. Given their impact, addressing the challenges associated with this phenomenon is crucial. In this paper, we present a rigorous methodology to identify a comprehensive set of existing Booters in the Internet. Before presenting our methodology, we illustrate the benefits of a set of booters on monitoring users from the Dutch NREN, SURFNet, from 2015 to 2017. Our methodology relies on well-defined mechanisms to generate a Booter list, from crawling suspect URLs to characterizing and classifying the collected URLs. The list obtained using the methodology presented in this paper has a classification accuracy of 95.5%, which is 10.5% better compared to previous work.

AB - The expansion of Distributed Denial of Service (DDoS)–for-hire websites, known as Booters, has radically modified both the scope and stakes of DDoS attacks. Until recently, however, Booters have only received little attention from the research community. Given their impact, addressing the challenges associated with this phenomenon is crucial. In this paper, we present a rigorous methodology to identify a comprehensive set of existing Booters in the Internet. Before presenting our methodology, we illustrate the benefits of a set of booters on monitoring users from the Dutch NREN, SURFNet, from 2015 to 2017. Our methodology relies on well-defined mechanisms to generate a Booter list, from crawling suspect URLs to characterizing and classifying the collected URLs. The list obtained using the methodology presented in this paper has a classification accuracy of 95.5%, which is 10.5% better compared to previous work.

UR - http://www.scopus.com/inward/record.url?scp=85040788655&partnerID=8YFLogxK

U2 - 10.1002/nem.2008

DO - 10.1002/nem.2008

M3 - Special issue

VL - 28

JO - International journal of network management

JF - International journal of network management

SN - 1099-1190

IS - 1

M1 - e2008

ER -