>> All right hi everyone.  So it's really a great thrill to be here to talk to you about our research.  Ills basically catching malware En Masse DNS and IP style.  My name is Dhia and I work at OpenDNS, I work as a Senior Security Researcher.  This is Thibault, our guru in data visualization, very smart guy and Andree the director of our network operations.  Very smart dude in terms of internet and DNS.  Let's look at the agenda today.  So we'll start with an introduction about open DNS global presence then dive into the main parts of the talk.  The first one is about catching malware from a DNS perspective and the second is looking at the IP structure and within the cases we will discuss and support that with a 3D visualization that we have.  We open sourced this week.  So open DNS has 22 data centers across the globe, 4 continents and that allows us to see a lot of traffic.  Mainly DNS of two times.  Recursive and authoritative.  That allows us to build a lot of useful models.  Now the first will be about catching malware in a DNS perspective but before that let's look at the, kind of crimeware ecosystem.  Mainly of today to give some foundations.  So here we see 4 components maybe.  The top part is when you visit the website that is compromised or delivering malicious ads you get some exploits, scripts running your machine seeing you have vulnerability and if that succeeds you will have a malware payload dropped on your box and it will try to phone back to some CnCs.  Usually they are domains and in this case they are hosted on fast flux proxy networks.  This is the focus of this part today.  And we'll be focusing on the Zbot one and they have a characteristic of TTL of 150 seconds.  And that's the focus of today.  Now a little bit about our research process, we start focusing on the Zbot proxy networks. One is using hadoop data. Most of it is on hdsf, the other one is using a streaming dns traffic, because we have streaming authoritative dns traffic coming in so use that. With that we can identify the malware and we also discovered a phony panel hosted on one of these proxy network domains. And then at the end we will share some stats on the botanic, samples and clients. 
What is Fast Flux? I'm sure most of you know about it. It's a dominion resolving to a lot of IPs scattered around the world or a single IP with a very low TTL. If we are talking about the Fast Flux proxy network it's a cloud in the middle with a lot of infected bugs they act as an intermediator or a shield for communication between the back on the left and the targets on the right.  Targets is usually in machines because they have valuable information you want to steal.  Then the communication would happen in two directions.  So if the targets get infected they will phone back to announce their existence, their status or data and the back fends they want to push extra payload they drop it on the box and further later it will be dropped on the target machines.  This case we look at the Zbot proxy fast network which has a TTL of 150 seconds.  Now we mentioned Zeus.  What is Zeus?  It's one of the most advanced crime world tool kits around.
[Applause].
These are the Zeus guys.  So they're going to load us with Zeus.  So Zeus is one of the most advanced crime ware tool kits around.  You feed it with an input which is usually a configuration file and web injects and the configuration file will have the binary ULSs and you give that to the builder and it will spit out the binary file.  (URL's).  Now on the other side you have a control panel and that one will let the adversary control his bot net because he will see what kind of machines got infected and he can monitor his gains.  This slide shows Zeus over the years.
>> Be quiet we don't care about Zeus.  We care about our new speakers.  Cheers.
[Applause].
>> All right thank you guys.  So yeah we were talking about Zeus.
>> Cyber!
>> Move on.
>> Venous.  Okay we are in Vegas.  So venous has a lot of CRC's and Fast Flux buttons and that's the focus of today.  Venous deserves files, binary files and drop zones.  How do we catch the CNC domains we have two methods.  The first one just for reference we use a language that allows it to process the data and we extract from a set of files within a certain time frame we'll extract Fast Flux domains then we build a graph then we extract the largest component.  That will give you empirically the bulk of the domains and IPs.  The other method is using the stream and it looks like that.  So we have a lot of fields that are of interest to you.  It's faster than doing like a batch processing from HDFS but you have to have your own filters to catch what you need because it's going fast.  So for that we can start with Zbot domains and milk them for IPs so you build a pool of IPs and you have the stream coming so you can grab the domains that have an IP or name server IP within that pool.  So having had that what wreck do is do more investigation using data visualization and people will tell us about it.
>> Thank you.  So he explained two different methods to extract some data linking Zbot and domains with their IPs.  So first let's look at how to visualize.  First we have the source data.  Then we can convert data using our own library and visualize it.  So this library this is a small library.  As you can see it's simple.  You can import the library here and create the graph and create a couple nodes and connect them using the nod keys then you can have ties and attributes.  That gives you the equivalent of the diagram you have on the right.  Let's look at how it looks like once we've extracted the data.  So what we're looking at here  ‑ ‑ 
[Applause].
Thank you.  So what we're looking at here are the domains in red and IPs in blue.  Then finally we can play that over time.  Three months.  So we can not that we have a growing field of the IPs are recycled and the domains go from one IP to another.  The way we constructed this animation is we took all the domains and IPs the first time and we monitored that over time and finally we can create a time line to see all the events and play it on the 3D.
>> Thank you Thibault.  Thanks to this investigation using visualization and it helped us confirm a few things.  The next step is to figure out what are these domains used for.  So it's okay to catch these domains, relatively easy but we see here that they are multipurpose.  On the left they're used by Zeus the generic Citadel, KINS and ICE IX in delivering the 3 types of URLs.  The other side you have Asprox which is a click fraud botanic and also a fishing in miscellaneous cases and you will find it in the white paper so I have it here for reference.  We saw Zeus URL's and also Citadel URL's on the Fast Flux domains, fishing URL's and Asprox  a lot of click fraud traffic using the CNC domains. Then this interesting case, this is what we call a DDoS block.  Here it's announcing the operating system it's running.  And furthermore what we did, these are some more cases of other malware using the domains.  Now this someone an interesting case where we discovered the hosted on one of these Fast Flux domains.  Pointy tries to steal passwords from a variety of applications on your machine and delivered by exploit kits or spam.  This is how it's advertised on some hacking forums.  Then this is how it's detected by some vendors.  Now if we look further into the structure of the website we'll see some interesting things.  But that's a base here for example it has a character set of (unknown) and a timezone is Moscow which is an indication of the origin of the writer or user of the panel.  We also see that it has the list of all of the applications it tries to steal passwords from.  Now just some snap shots for your reference.  You can find them in the white paper.  And a few more here.  Now the next thing we did was to search for some key words we found on the panel and try to find anything related or similar.  And we found like this website that is hosting another piece of malware and this one happens to be [andromida] botnet malware.  And then we looked more websites having the same structure as the original panel. Now let's look at the domains and how they are, what's their structure or like where do they come from.  So they are using mostly dot RU and SU, so this is the origin or the geographical location of the actors I would say.  If you look at the bots, where are they mostly located, you see them mainly in Russia and Ukraine.  This is an Eastern European operation to some extent.  However if you look at the clients looking up the domains over 24 hours you can see they're in the U.S.  Well, you can say that's mainly it's because of traffic in the U.S. but also maybe because a lot of valuable information is in a lot of North American machines, mainly banking machines.  Zeus is a banking Trojan so it would make sense.  Finally what we did with the Fast Flux domains is we saw what malware is going back to them.  We saw with no surprise that Zbot is the top list and also Upatre. Upatre is like a first stage bring down on your machine. It brings down your machine extra maliciousness and in this case it's involved with Zeus came over like a variant of Zeus.  
 So in summary about dealing with DNS we shared with you information and research about the Zbot Fast Flux proxy network.  Fast Flux has been around.  In this case fast flocks proxy network is alive, it's very active and multipurpose and used by a variety of malware and it's merely hosted in Russia and Ukraine targeting machines in North America and mostly abusing .ru and .su .com most abused TLDs. That's kind of interesting to look at this very current threat. 
Now having covered the venous style how about the IP style because that's the complement of the study here.  So for that we looked at two different things.  Usually reputation systems they assign scores to IPs, prefixes or ASNs but counting the number of IPs or domains in the structures or entities.  In our study we wanted to enrich that because that's kind of weak sometimes and we wanted to look at the granularity. In one case finer than the BgB prefix which is sub allocated ranges. Say you have a prefix of /16 you want to look at smaller granularity, like /28 and 29.  On the other end you want the ASN graph because it's larger than the single ASN, if you're just counting numbers, and that gives us a lot of valuable intelligence and we were able to build some really cool models.  So the first one is about the malicious sub allocated ranges.  The investigation process is always trying to start with domains and IPs and in this case we investigated the sub allocate the ranges and we did the same thing to see what kind of servers they were running.  With that we were able to follow the TTP of the adversaries like the way they operate and how they bring the infrastructure online and the timing.  Then after that we were able to generalize the predictions to block before they started delivering the attacks.  That was really like ground breaking.  Then over time we were able to see the shift in the operations of the adversaries.  So we'll start with this example that we covered over several months.  This was about nuclear exploited domains and they were abusing in Canada for months.  They were basically reserving IPs, certain customers suspicious ones, and these IPs they were ones like /28, 29, 30.  Brought online all at once, altogether and that lasted for several months delivering nuclear exploit kit domains.  After a few months they shifted to a Ukraine hosted provider than lasted for 7 days.  In this case however, they shifting MO because OVH Canada is in the air space and you were able to grab information about customers reserving IPs by looking at the 'who is'.  Ukraine is in the ripe space and that's much difficult because it's scarce.  Also the IPs were brought online one at a time and also in randomized fashion.  This is a way to evade detection.  Then they shifted to another provider.  This one is in Russia.  So the Russian one was keeping the same MO and then they went back to OVH.  In this case it was the same people reserving the IPs, the ranges but the MO changed a little bit.  Now they are using recycled IPs.  IPs that hosted old content or have a rather clean score.  And again these are like ways to evade IP reputation system that is a lot of security vendor’s use.  These guys are really smart.  They react and adapt and try to evade you and give you a hard time.  However over this period the name servers were hosted on OVH space.  So you might think name servers are much more difficult to prove to be malicious whereas the domains themselves they are easier if you can grab it and that's kind of easier to prove it's related to a certain exploit kit.  Now this animation shows you the (unrecognized) pattern of these domains.  You have a lot of them pop on a single IP, kind of a firework pattern.  It's kind of a high works pattern here over time and they just like die out after a few minutes or few hours.  So it's a very interesting case here.  Registering domains, delivering the attacks then just dying and never coming back.  Now we did the blog back in February about the study and we also took down a lot of the domains in corporation with the research group malware must die.  Having said that how can we push this further and kind of give a hard time back to the adversaries?
>> What’s your prediction look like?
>> Prediction?
>> Yes, prediction?
[Inaudible].
[Applause].
>> Okay this one is one of my favorite ones.  So Mr. T is inflicting pain on Rocky.  Real try to do the same on these adversaries.  Let's look at this case here, this automatic thing...  Okay stop there.  So we looked at these reserved IP ranges over time and we see that they reserved 28 ranges December and within them 1e6 IPs, 86 are used and 63  percent of them are malicious and you see the trend growing.  Like in February it was 92  percent maliciousness.  The point I'm trying to make here is these guys reserve these ranges, they deliver the attacks with a high percentage on these IPs.  So it's no coincidence they're not using them for other purposes.  It's specifically targeted and trying to abuse the hosting provider.  Now the point here is that if you look at the bgb prefixes where these IPs are living you will see it's a very course granularity.  It's a huge one, 17/18/19.  You got a lot of IPs to look at in these big ranges.  So you cannot get that nice laser sharp view of what is going on.  Whereas if you do the IP ranges finer study that gives you a lot more visibility into what's going on and how the bad actors or adversaries are thinking.  Now the other interesting thing we did this tried to fingerprint the IPs.  When we discovered them we know they're reserved by the same guys they had the same exact server set up.  The first is Ukraine then the Russian and it's the same with OVH Canada.  So the point here is, by looking at the by the same guys and same fingerprints and we saw over time they always serve the attacks, again this is a preestablished operation being carried over and over again and it's no coincidence so it's interesting to see that knowing those facts we're able to predictively block these IPs before any domains start resolving to them.  So that's kind of the breakthrough in the study.  Now over time we also saw the adversaries were shifting MO.  Now they know what we know.  Sought trend we saw growing is that they started abusing compromised domains like domains were like benign, injected with sub domains under them and we did a study about that.  So we started detecting that and we collected we collected the sub IPs that were the sub domains and we had a list of all the most abused ASNs.  We were looking also at the finer granularity than the big ASN's so we looked at small scale providers trying to see if they were abused or rogue.  Then over time we were able to kind of see the evolution of the techniques and methods of these adversaries.  And that was quite  interesting.  So in this case these malicious sub domains were delivering exploit kits mainly and they were dropping Zeus variance if the infection change succeeds and go daddy was the most abused in this case unfortunately for them.  Now looking at the top abused ASNs again OVH is on top.  18  percent of the IPs were malicious were from OVH and we also have ASNs scattered across Europe or into North America.  Now this table here summarizes the evolution of the TTP of the adversaries.  This one is really cool.  I like it because it kind of gives you the whole picture.  So before like a few months ago and now is the current state.  So they used to abuse registered domains under certain ccTLDs and exclusively use them for the attacks.  Now days they complement that with abused sub domains.  The second thing is the IPs they reserved were all exclusively for attacks.  Now a days they complement with recycled IPs and legit stuff.  And third they used to bring the IPs all in continuous chunks altogether.  Now days it's like randomized one at a time whenever they feel like it.  Again it's like evasion techniques.  Finally we said they used to abuse OVH Canada and it was possible to take advantage of the air who is  because it tells the customers reserving the IPs.  Now they using OVH Europe and its the ripe space which is crossing details and on top of that they are using different countries IP pools.  So this is clearly a very interesting way they shift operations and methods.  But we were able to kind of follow them over time.  This one here is about the fine grain hosting perspective so these are like small scalable hosting providers.  Mainly serving maliciousness.  This guy here, another one in Russia and another in Bulgaria and this one electric kitten unfortunately abused in North America.  Then a few more for your reference.  Finally what we did here is look at the sub domains like the labels that are injected under let's say Go Daddy domains.  Usually it's like 3 labels.  You have police.homebusiness.com.  So the top used one were police and alert police.  We thought maybe this is related to the theme of the attack and that was the case.  Like the first two they were used for browser based ware which is a web page in pops up saying you've been looking at weird stuff, porn or what not and the FBI or local police will come after you if you don't pay a ransom.  You can kill it by killing the scripts or the browser process.  It's kind of a nuisance more than a threat.  But still the labels related to the attacks in this case.  The rest were mainly randomized but extracted from English like dictionaries. So, I know we have covered a lot. It was mostly DNS perspective and IPS perspective by looking at sub allocated ranges and we mentioned earlier the view of the ASN graph topology. So, before we get into that, we want to know more more details about the internet structure.
>> Oh, man he's awake.  So yeah the next section we'll take a closer look at how we can use ASN relationships and relationships on the internet with prefixes to detect more malware.  Before we do that we need to make sure we're on the same page and understand how the internet works .  When we talked to different people we got different replies.  For example, if I ask my dad what the internet looks like he will probably point to the cable modem.  If I ask the sales guy he says something different and the next room is where the IT guy is and I say do you know what it looks like or can you explain it to me and giggle because it reminds him of one episode of the IT Crowd where you got to borrow the internet for a day, the elders of the internet. It was this magic black book, it had blinking lights on it as you can see and wireless. But obviously the internet is no magic black book.  In fact it is much moor beautiful. I guess if you wanted to paint a picture of the internet, this is sort of what it would look like.  We have a few more.  We do a lot of visualization so in the next few slides you will see more.  But the internet obviously as you know it's a network of networks, and it's a graph, we love graphs. So in this picture each dot represents an autonomous system and an autonomous system on the internet is basically one organization.  So open DNS is autonomous system, Google is an autonomous system, AT&T is an autonomous system, Verizon and so on and so forth.  And each of these systems is identified by a number which we call an AS number or sometimes an ASM.  Then each ASM has been allocated or announces one or more IP 4 or 6 prefixes. It can be one or it can be several thousands. That's basically how it works. So we have all these ASMs, they are connected to one another or at least one other because you need connectivity to others. So, now imagine you are on the left-hand side of this graph and want to get to the right-hand side. You need to know how to get there, and so that is why we need a routing protocol which is called VGP. VGP will distribute all this information. VGP in itself is a really interesting talk especially what you can do with that. It's a little out of scope for this but basically we're building a graph using VGP data.You can find all kinds of public data, Routeviews, we use our own data.  Just so you know there's about half a million prefixes out there and about 48,000 ASM so you can build a really large one which has challenges when you start to visualize.  That these are just some references but yeah this is how you build it.  Focus on the last line, which are 2 items.  One is the actual prefix which is 67.215.94.0/24, then the next part is the AS and that shows how ASM he is are connected to each other.  You can infer all kinds of interesting data from this. In this case the one on the right hand side, 36692 is open DNS and connected and it's connected to 2914 from that I know that's MTT so open up from MTT so on and so forth.  You can see all kinds of interesting data from that.  Then basically produce it rough then we can use that for further analysis.
>> Thank you Andree.  So he just described how to create the graph data set from the bgb routing tables.  So same thing.  We create with the same concept, the same library we can create a graph data set.  Then we need to use very, very simple particle physics.  So even if you're not math nerds don't run away it's very simple.  Essentially the concept is very simple, you take your graph and all pair of nods that's connected and attract themselves to a certain point and every pair of nods not connected will repulse each other. So, you can see here two different forces here.  Attractive force and repulsive force.  They all depend on distance and they can be manipulated by constant C.  Which is like multiplied by the square root of the already divided by number, lot of complicated words just to say factor the density.  You can control the density of the layout just by this constant C.  Okay, so what's it look like.  We start with other nodes in the same position, random fashion, cube, or sphere.  Doesn't really matter than then we start running the particle physics.  What you see here is the explosion, the graphic expanding in space.  So all the nodes are connected together and they will stick together and all the nodes that disconnect will repulse.  So you can see the layout looks like molecules which makes sense because the force directed algorithm is inspired by electrical forces and also forces for celestial bodies.  It's not exactly the same model because it's way too complicated to implement but still it's very close.  Then finally you can see the nodes are vibrating.  This means other forces are becoming even and that usually the graph has reached an equilibrium state. 
[Inaudible].
This is really cool but doesn't work well on scale so we have to take advantage of parallelization.  So essentially we run the same thing on the GPU and use a library called Open CL.  Actually it's more like a specification because it can be implemented GA, CPUs, etc.  But anyway essentially Open CL is very simple.  It exposes a couple of work groups and like work items which are pretty much cores and threads in the GPU, and different kinds of memory like local memory, private memory. Private memory is pretty much the resisters and google memory is the memory of the GPU. Essentially it's like a tradeoff between the ease of access of the memory and the performance because the private memory is actually very fast to access.  Okay main points.  Why are we doing this?  We look at the pictures, okay that's really cool but what's the point in the main point is the layout is data driven versus user driven.  As you can see the layout depends on the forces and forces depend on the connections between the nod.  So the results is a layout and depends on the data structure you're looking at.  It is much closer to what I like to call the natural shape of the data model that you're looking at.  We take advantage of the GPU for acceleration.  We know GPU is becoming insanely fast to operate.  So it would be a shame not to take advantage of that and finally main point humans are so much better at processing shapes and color than text data.  So let's see what it looks like.  We'll look at the whole process.  
So we take the whole DNS graph. So, like I said, it's placed in a random fashion. A big mess of ASN nods. Rotate around. So on this layout you don't see the edges because usually the process runs off line.  It's just for the performance case we're trying to go as fast as possible here.  Then we start the force directed process.  As you can see it's a very heavy process.  Every iteration, I think I had like 0.3 durations per second.  So like close to 3 durations per second.  0.3 durations per second.  So that runs a GTX550.  A graphic that's like 3, 4 years old - something like that. Then that runs for an hour.  The results is something like this.  So as you can see Andree will give us his expertise on the graph but you can see the network is densely connected and has a strong core and we have kind of a sparse noids around.  Then we can extract or create pictures that looks like this.
>> :  If you are a network geek this is sort of what it looks like and network engineering we use sort of the loosely defined terms, loosely defined, tier 1, tier 2, tier 3, tier 1 is the core of the internet. There's only a dozen or so of them …oops, sorry, ATT, NTT, some of those.  Then around that so those are the pink ones are sort of the regional larger regional networks then at the edge is where you have your web posters and people like open DNS, FB and people like that who don't provide connectivity to others.  This is another picture where you can really clearly see that.  But in this you can see the different clusters which show sort of the regional networks and typically these different clusters represent different countries.  This is an animation of the internet in the Ukraine and it shows that Ukraine is relying on only a few sort of upstream networks.  So if you want to do something bad if you are able to take that autonomous system out of rotation then you would probably be able to put up a significant portion of a country and we've seen similar things like that in Egypt. Egypt being taken off line.  It's only possible because there were 3 or 4 major carriers this that country and more recently in Syria where there's only one national Telco, if you shut that down the whole country is off line.  It's ironic because the internet was made to survive nuclear warfare and blah blah blah and no single points of failure.  The way the internet is built in a lot of countries is they're still relying on one or two networks and if you take that one out you will be able to take a significant portion of it.  So I think this is a really good picture to represent that.  So...  
[Applause].
>> This stuff is awesome.  So thank you for this perspective of the ASN network.  Now the thing is we're looking after maliciousness.  That was the core of the research.  Now how can we use the graph to extract maliciousness?  We're introducing the concept of suspicious or sick blink peripheral ASNs then we look for suspicious ones.  We look at domains and IPs and study the fingerprints and ranges that we are focused on then that allows us to build relationships between the ASNs by considering the toe poling and then we can verify the AS Ns.  This is kind of a breakthrough in case.  You will see.  Now the malware we're looking at is some kind of a Trojan here hosted on the/24,/24 and we took a sample of these IPs.  This is how it's described by AV vendors and we took the sample of IPs and we did the fingerprinting again and we saw an interesting case of the previous study which often have the same server set up.  So we have two clusters of server set ups.  This is set up in bulk.  Now looking at the ASN graph topology:  These here are kind of brothers and sisters.  Peripheral because they have no downstream providers.  They are on the out skirts or periphery of the internet.  Now we look for suspicious ones in this case.  So this is a graph we took a snap shot from the Ukrainian Russian IP pace in January and we see ASNs, siblings and peripheral and one of the parents is doing the same.  A month and a half later one of the parents stopped advertising the kid’s prefixes and more of the children are now hosting the malicious payload.  Now the thing is we looked at the entire pool of IPs and we saw a lot of domains hosted on them and we also saw the payload URL's were live.  So the point here is that this is an operation established in bulk in advance to deliver this Trojan payload and the thing is we saw this across different kind of IP spaces.  So this was a case we are talking about but we wanted to scale it up and use it on a global fashion and here is the introduction from T‑ bow perspective.
>> :  Sure I would like to give an official approach of the model so we're all on the same page and make sure we're talking about the same thing.  So when we look at the graph, when we study graph topology usually we interested in the number of connections.  Then we can classify all the  Noids depending on the number of connections that we have.  So as you can see here there's a blue nod called a sync nod because it has in coming connections and the green is the leaf nod.  It only has one outgoing connection and finally the red one is the source nods and the source nods are like two or more outgoing connections and the white ones don't respond to the same criteria.  So when we apply the detection this is what happens.  Essentially we keep only the peripheral nod which are the nods that don't have any in coming connections.  Like the suburbs.  Then we keep their parents and the results is pretty much a graph with all the peripheral nodes and their siblings.  Including their parents as well.  So we can apply this on the same data set for example if Ukraine which is relevant in this case, so the same data set before, same color code so you can see the peripheral nodes are red and green ones and finally when we apply the filter when we extract we pretty much prune the core of the DNS network.  This one has a couple of leaves connected to the same parents.  So that would be like an interesting candidate for us to look at.  Now if you look at the whole DNS network here, I mean the Ukrainian one you can see there's a lot of candidates so another better approach to start from one noid malicious ASN and see if it has siblings.
>> Okay cool.  So I want to do one step back and sort of summarize what was just said.  What we found was basically a whole bunch of prefixes that were hosted by different ASMs.  The ones in red were hosting similar type of malware and when we scanned them we had the same exact fingerprints.  And at some point some were used to hosting malware but others we knew they were coming on in the future.  Why is this interesting?  Because typically we look at malware on maybe a domain level or IP name level and sometimes on an AS level but what seems to be the case here is these bad guys or guys hosting this were actually hide not guilty different ASMs and typically an ASN is one of administrative domain.  So it seems like this group of ASN is one of administrative domain.  Owned and operated by one guy.  So how can we prove that?  It's our hypothesis.  So we figured maybe if one of these ASN's goes down and they were owned and operated by the same guy returning the same infrastructure all the others must go down as well because they're running the same infrastructure.  That was the idea.  How can we prove that?  We looked at the data.  So we used data from the guys, they had like 2 years worth of all the outages on the internet.  You can look at update messages, those are the two main BGP messages and I will not go into detail but if you look at it and the prefix is unreachable and an hour later there's an update then you can correlate when there's an outage.  So that's what we did and looked at all DNSs and looked for outages and this was the result.  Basically it's a table showing the ASNs and the overlapping at the same time and the main take away is the numbers are really high over the course of 6 months or so.  So I'm zooming in to the upstream ASN.  If the upstream goes down then elders must go down as well.  Makes sense.  But what we see in this case is the upstream one provider maintained up and running for most of the time but the two other ones went down 22 times at the exact same time over the course of 6 months.  Here are two examples.  This is just for the month of July.  Again a bunch of text but you can see that or what it shows is two of these AS Ns went down at the exact same time., exact same time, exact same start time, end time, duration.  What does that mean?  I think we proved that these different ASN recent actually owned and operated by the same guys.  They just hide.  So we're sure they rely on the same infrastructure.  It could be the same data center or router or switch.  But we're definitely sure that it's the same organization and in fact you might even go further and say it could be hosted on the same physical hardware, same servers are multiple IP addresses.  But it's a unique approach to find these sibling ASNs that could be related and it allows us to quickly if we know about ASNs we'll run it and it tells us which ones are related and we can then zoom into that.  So that's pretty cool actually.
[Applause].
>> Thanks Thibault and Andree for the perspective on the ANS network.  So in conclusion what we shared with you was the research about catching maliciousness on the internet for DNS and IP.  How can we use the ASN graph to extract the maliciousness we are after. We are introducing the concept of suspicious or actually sibling peripheral ASNs and then we look for suspicious ones. We look at IPS and domains and study fingerprints and the ranges that we are focused on. And that allows us begin a relationship between the ASNs by considering the ASN topology, the ASN graph topology. And then thanks to that we can build a model and finally we are proposing a novel approach, we will talk about it later, to verify the relationships between ASN by monitoring bgp outages. This is kind of a break through in this case. Now, the malware we're looking at was some kind of a trojan here hosted on /23 or /24s. And we took a sample of these IPs. This is how it's described on vt by some av vendors. We took the samples of the fingerprints again and we saw the case of the previous study which is all of them have the same server set up. Two clusters of server set ups here. So this is an operation set up in bulk in advance. Now looking at the ASN graph topology we introduced the concept of SPN. SNP is sibling peripheral nods. Sibling in the sense that, you see the top ASN, they share the same upstream provider at the bottom, they rely on him to provide the advertise his prefixes. So they are kind of brothers and sisters in a way. And peripheral because they have no downstream providers. So they are on the peripheral or outside of the internet. So we look for suspicious ones in this case. So this is a subgraph we took. From the Ukraine, Russia space in January. You see a bunch of these ASNs hosting, because they are in red, the malicious payload. And one of the parents is also doing the same. A month and a half later one of the parents detached itself and stopped advertising the kids bpg prefixes. More of the children are now hosting the malicious payload. Now the thing is, we looked at the entire pool of IPs and we sw a lot of domains hosted on them. We also saw the payloads were live before any domains started resolving to them. So the point here is, that this is an operation established  in bulk in advance and delivered this Trojan payload and others across different kinds of IP spaces. So, this is a case we are talking about but we wanted to scale it up and use it on a global fashion. And here comes the introduction of SPN from Thibault's perspective.
>> I like to give a visual approach of the SPN models so we are all on the same page and talking about the same things. When we study graph topology usually we are interested in different fetters. One of them is the green of the nods, the number of connections. And we can classify the number of the noids depending on the number of connections we have. There is a blue noid, called the synch noid, it has incoming connections. You have the green, it's called the leaf. It only has one outgoing connection, then finally the red ones, they are like the source noids. The source noids have 2 or more outgoing connections. And the white ones are the ones that really don't respond to. So when we apply the SPN detection, this is what happens. Essentially we only keep the peripheral noids, which are the noids that don't have any incoming connections. It's like the suburbs. And then we keep their parents, it's pretty much with the peripheral and their siblings, and including their parents as well. So we can apply this on the same data set for example in Ukraine which was an (unclear) in this case. So this is the same data set, same code, so you can see all the noids, peripheral ones, red and green ones. And finally when we apply the filter we extract the SPN graph you know. That will pretty much prune the core of the SPN network. Then we can select a couple candidates, like this one for example. This one has a couple of leaves connected together to the same parents. So that would be a very interesting candidate for us to look at. So, if you look at the whole DNS network, here the Ukrainian one. You can see there are a lot of candidates. So another better approach , to start with known malicious suspicious with siblings. It's a peripheral noid if it has siblings. 
>> So, I want to do one step back and summarize what Dhia just said. So what we found was a whole bunch of prefixes that were hosted by different ANSs - the ones in red were hosting similar types of malware and they had the exact same fingerprints. And at some point some were used for hosting malware and others not yet. They were coming on in the future. What is interesting is typically with blocking malware it will be on a domain name level, an IP name level or even sometimes on a complete AS level. But what appeared to be the case here was these bad guys, the guys hosting, were actually hiding in different ASNs. And typically one ASN is one administrative domain right. So this looks like this one group of ASN is one domain, owned and operated by one guy. Okay, so we say, how can we prove that. So our assumption, our hypothesis. So we figure if maybe, if one of these ASNs goes down and is actually owned and operated by guy running on one infrastructure then all the others must go down as well. That was sort of the idea. So we looked at how can we prove that. So we looked at BGP outages data. So we used data bgpmon.net. They have all the information from the past 2 years for all the outages on the internet that you can query. How does that work. You can look at update messages, withdrawal messages. These are the 2 main BPG messages and I'm not going to go into withdrawals. Prefixes are unreachable and then an hour later is an update and you do that from hundreds of routers at the same time. Then you basically correlate when there's an outage. So, that's what we did. We checked to see if there were overlaying outages. And this was a lot of text I know, a lot of numbers. It's basically an overlaying table of the ASNs and the overlaying and outages at the same time. And the main take away here is that the numbers are really high. This is over the course of 6 months or so. So, I'm zooming in to 3 ASNs, one is the upstream, because obviously if the upstream goes down, it's called 48361 then all the rest must go down. Makes total sense. But what we see in this one is the upstream provider maintains up and running for most of the time the 2 other ones went down 22 times at the exact same time over the course of 6 months. So, here are 2 examples, just for the month of July, again a bunch of text but you can see, what it shows that 2 of these ASNs went down at the exact same time, some for 479 minutes, 33 minutes, 63 minutes,  etc.  Exact same start time, end time, duration. So what does that mean? I think it proves that with these different ASNs are actually owned and operated by the same guys. They just have multiple ASNs and hiding behind that.  So we can be sure they are relying on the same data structure, could be the same router, the same switch. The switch goes down, the whole thing goes down. But we are definitely sure it is the same organization and you might go further and say it's even being hosted on the same physical hardware, same servers have multiple IP addresses running on different ASNs. 
Anyway, it is a unique way to find these sibling ASNs that could be related and it also allows us to quickly if we know about ASN, we will just run the script and it will tell us which ASN script is related, the outages and then we can zoom into that. So, that's pretty cool I think.  
[Applause].
>> So, in conclusion what we shared with you was about capturing maliciousness on the internet from a DNS perspective. For DNS we looked at the Zbot fast flux proxy network. We described how catch the domains and how it's purpose is highly used by malware. And then on the IP side we looked at two granularities.  We introduced a novel approach to monitor relationships based on the outages and we also proposed the model of SPN which is also catching related ones that have the same kind of suspicious purpose and finally we opened sourced our 3D visualization engine that Thibault described so you should use it and contribute back.  It's all for the community and we'll be very happy to see you contribute back.
[Applause].
>> Some of the references we used then you can follow us on Twitter to keep in touch and thank you again and if you have any questions and we have the time feel free to ask.
[Applause].