Under the Shadow of Sunshine - Understanding and Detecting Bulletproof Hosting
Explore the emerging trend of Bulletproof Hosting (BPH) services utilizing legitimate service provider networks in this 15-minute IEEE conference talk. Delve into the challenges posed by this shift in criminal infrastructure and learn about a novel approach to detect malicious sub-allocated network blocks. Discover how the researchers analyzed vast amounts of data, including Whois snapshots, passive DNS data, and blacklist feeds, to identify unique features characterizing BPH on sub-allocations. Examine the effectiveness of their classifier, which achieved a 98% recall and 1.5% false discovery rate. Gain insights into the underground BPH ecosystem, including patterns of network block recycling and client migration. Understand the implications of this agile BPH trend and potential methods for detecting and mitigating this evolving security threat.