Identifying botnets before an attack: The new DARPA challenge

Share this…

The agency recently awarded a contract to develop an Internet scanning tool for inactive botnets

Experts in ethical hacking from the International Institute of Cyber Security report that the Defense Advanced Research Projects Agency (DARPA) is investing in the development of systems that automatically locate and dismantle botnets before hackers use them to attack websites, businesses, or even whole countries.

Last August 30th, DARPA awarded a $1.2M USD contract to the cybersecurity firm Packet Forensics to develop new ways of locating and identifying these hidden armies on the Internet. This stimulus is part of the Harnessing Autonomy for Countering Cyber-Adversary Systems (HACCS) program, designed for experts in ethical hacking and cybersecurity, DARPA spokespersons said.

To create botnets, hackers infect Internet-connected devices with malware that allows them to run commands from a remote server. Because the virus remains dormant most of the time, owners of infected devices rarely know that their computer, smartphone, or any other device has been compromised.

Through the HACCS program, DARPA aims to build a system that can automatically identify devices infected with botnet malware and disable them without their owners knowing.

Issued in 2017, the program is investing mainly in three different types of technology:

  • Systems that identify and fingerprint botnets over the Internet
  • Tools that load software to infected devices through known security breaches
  • Software that disables the botnet malware once it is loaded

The future plan is that DARPA can integrate each of these technologies into a single system that can detect, attack, and neutralize botnet-infected devices without the need for human interaction. Because the tool would only attack the botnet malware, people could continue to use the devices on a regular basis, the agency’s ethical hacking specialists mentioned.

During project’s first stage, the firm Packet Forensics will have to create a technology capable of scanning nearly 5% of the global IP addresses and detecting botnets with 80% accuracy. At final stages of the program, DARPA anticipates that the system will analyze the 80% of the Internet at global level and detect botnets with 95% effectiveness.