{'fraction_non_alphanumeric': 0.017964071856287425, 'fraction_numerical': 0.006986027944111776, 'mean_word_length': 5.470967741935484, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Estimating Botnet Populations from Attack Traffic

Botnets are one of the most significant perpetrators of malicious network activity; the virulence and, in particular, the number of active bots at any given time remains an open question. Previous studies have attempted to detect and monitor active bots through their “command and control” channels. This paper devises and evaluates a complementary approach: we monitor attack traffic (specifically, spamming behavior as observed at thousands of mail filtering appliances) to estimate bot populations. Our estimation method draws on population estimation techniques inspired by biology: We apply a variant of capture-recapture to logs from a large spam filtering provider that receives 300 million email messages per day from more than 8,000 unique domains. We validate our technique by comparing our estimates for the size of the Storm botnet against conventional estimation techniques and study the fluctuations in population over a two-week period.