Software Engineering Institute

This paper was presented at  the Internet Measurement Conference 2007, which took place in October 2007, in San Diego, California. The conference was sponsored by ACM SIGCOMM in cooperation with USENIX.

The increased use of botnets as an attack tool and the awareness attackers have of blocking lists leads to the question of whether we can effectively predict future bot locations. To that end, we introduce a network quality that we term uncleanliness: an indicator of the propensity for hosts in a network to be compromised by outside parties.

We hypothesize that unclean networks will demonstrate two properties: spatial and temporal uncleanliness. Spatial uncleanliness is the tendency for compromised hosts to cluster more densely within unclean networks. Temporal uncleanliness is the tendency for unclean networks to contain compromised hosts for extended periods. 

We test for these properties by collating data from multiple indicators (spamming, phishing, scanning and botnet IRC log monitoring). We demonstrate evidence for both spatial and temporal uncleanliness. We further show evidence for cross-relationship between the various datasets, showing that botnet activity predicts spamming and scanning, while phishing activity appears to be unrelated to the other indicators.