Buttinsky - Botnet Monitoring \o/Please pronounce with a Russian accent...
Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. The Buttinsky project will provide an open source framework for automated botnet monitoring.
The modular design will allow full customization of the used protocols, the monitoring clients behavior, how we log the collected information, processing of the data to analyze the botnets purpose, size and threat and how the monitoring task are distributed between dedicated nodes
Our motivation was the simple lack of a proper, freely (no, there is no free beer) available tool.
What is your reason for writing your own monitoring tool?
Botnet monitoring is a process of actively joining a botnet infrastructure in order to learn about its inner workings for research and analysis purposes. One clear distinction between a real bot and a monitoring bot is that the monitoring bot does not perform any harmful actions when instructed to by the bot herder. If the monitoring bot can collect information we will be able to understand what is going on inside the botnet and also find weaknesses and design flaws of the botnet protocol. This information can then be used for botnet takedown.
There are currently two available but very specialized tools from project members, both with a different approach and goal. Hale with the more manual and customizable approach and the automated and IRC botnet specific WSBS. In this proposed project we want to build a strong monitoring framework based on a combined version of the previous solutions.
With Buttinsky we are building a versatile monitoring platform which will provide the cornerstones for your customized solution. The features will include but are not restricted to:
As we are building a project from scratch, first milestone includes further design planning and basic implementation of the
framework architecture. Additionally we implement the client manager, responsible for controlling the monitoring clients,
and the client on the TCP layer.
Until now there is not much to see but if you are interested in shaping this project with us, feel free to join us on GitHub.
Captain Nemo of the team, he silently saves the net. AARRGHfirstname.lastname@example.org