Researchers Try to Stalk Botnets Used by Hackers
Researchers at Sandia National Laboratories in Livermore, Calif., are creating what is in effect a vast digital petri dish able to hold one million operating systems at once in an effort to study the behavior of rogue programs known as botnets.
Context & Ripple Effects
Sandia's million-OS 'digital petri dish' extends an idea already circulating in the security research community: in April 2008, New Scientist argued the way to defeat a malicious botnet was to build a friendly one, studying its spread under controlled conditions rather than chasing infections piecemeal in the wild.
What changed by July 2009 is scale. Where earlier proposals contemplated small test populations, Sandia's Livermore facility aims to run one million operating systems simultaneously — turning botnet observation into something closer to a laboratory discipline than forensic cleanup, and putting a DOE weapons lab at the center of civilian malware research.
First-order effects
- Security researchers gain, for the first time, a venue where botnet behavior can be observed across a population the size of a real-world infection at once, rather than inferred from sampled honeypots and post-mortem forensics.
Second-order effects
- Commercial antivirus vendors and network operators become the likely consumers of whatever behavioral signatures emerge from such runs — shifting product roadmaps toward detecting propagation patterns rather than matching individual binary samples.
Third-order effects
- If large-scale emulation proves out, malware defense migrates from reactive cleanup toward pre-emptive study, and national laboratories compete with universities and vendors as the infrastructure tier of cybersecurity research.
The trend: Botnet defense is moving from chasing infected machines after the fact to emulating entire networks before the fact, with government labs supplying the compute that makes the shift possible.