Recommendations for the Remediation of Bots in ISP Networks

Abstract

Status of This Memo This document is not an Internet Standards Track specification; it is published for informational purposes. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6561.

Report from the Internet of Things Software Update (IoTSU) Workshop 2016

“…-RFC 6561 [RFC6561] describes one scheme for an ISP to send "signals" to customers about hosts (usually those that are part of a botnet or generating spam) in their home network.…”

ISPs and Ad Networks Against Botnet Ad Fraud

“…A new IETF intitiative focuses on how ISPs can manage the effects of devices used by their subscribers, detect those that have been infected with malicious bots, notify the subscribers and remediate the infection via various techniques [20]. The Internet Industry Association (IIA) has also drafted a new code of conduct that suggests ISPs should detect malware-infected machines of their subscribers and actually take the action to address the problem [24].…”

“…The AN has an economic incentive to fund the ISP to perform detection of the botnets and remediation of the infected devices, as discussed in Section 3. To detect bots in the network, the ISP must deploy a detection system [20,24]. We note the deployment cost of the detection system as c D and we assume that such a system can successfully detect a fraction P D of the bots in the network.…”

“…Recent initiatives propose that ISPs should perform the detection of botnets and remediation of the infected devices [20] [24]. Indeed, it is the ISPs that are in the best position to detect the presence of a botnet and to take measures against it.…”

HADEGA: A novel MPLS-based mitigation solution to handle network attacks

“…They also result in additional costs for network service providers, e.g., waste of network resources, financial losses due to network interruptions, or several other side effects. In fact, service providers are crucial in order to counter and neutralize network attacks [5]. Therefore, it is essential to provide them with appropriate mitigation techniques fitting their large scale networks and already deployed technologies.…”