Performing realistic simulations of Internet packet traffic on a national or global level is a daunting task from both the modeling and the computational perspective. We present the MIITS (Multi-scale Integrated Information and Telecommunications System) tool that implements a novel approach to network simulation and report first scaling results from a realistic Internet scenario. MIITS' end-to-end approach to network simulation relies on modules for (i) accurate network topology and capacity representation, (ii) realistic communication session generation based on the activities of an agent population that is statistically equivalent to the population in a large metropolitan area, (iii) the actual scalable packet-level network simulation that is based on distributed event-driven technology, and (iv) analysis of large amounts of simulation output data. We present a sample simulation of a Los Angeles network as an intermediate step toward the vision of national-level simulation.

Abstract-Botnets are one of the most serious security threats to the Internet and its end users. In recent years, utilizing P2P as a Command and Control (C&C) protocol has become popular due to its decentralized nature that can help hide the botmaster's identity. Most bot detection approaches targeting P2P botnets either rely on behavior monitoring or traffic flow and packet analysis, requiring fine-grained information collected locally. This requirement limits the scale of detection. In this paper, we consider detection of P2P botnets at a high-levelthe infrastructure level-by exploiting their structural properties from a graph analysis perspective. Using three different P2P overlay structures, we measure the effectiveness of detecting each structure at various locations (the Autonomous System (AS), the Point of Presence (PoP), and the router rendezvous) in the Internet infrastructure.