The case for in-the-lab botnet experimentation: creating and taking down a 3000-node botnet

Botnets constitute a serious security problem. A lot of effort has been invested towards understanding them better, while develop-ing and learning how to deploy effective counter-measures against them. Their study via various analysis, modelling and experimen-tal methods are integral parts of the development cycle of any such botnet mitigation schemes. It also constitutes a vital part of the pro-cess of understanding present threats and predicting future ones. Currently, the most popular of these techniques are “in-the-wild” botnet studies, where researchers interact directly with real-world botnets. This approach is less than ideal, for many reasons that we discuss in this paper, including scientific validity, ethical and legal issues. Consequently, we present an alternative approach employ-ing “in the lab ” experiments involving at-scale emulated botnets. We discuss the advantages of such an approach over reverse engi