Recommendations for the Remediation of Bots in ISP Networks

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 29
Abstract: This document contains recommendations on how Internet Service Providers can use various remediation techniques to manage the effects of malicious bot infestations on computers used by their subscribers. Internet users with infected computers are exposed to risks such as loss of personal data and increased susceptibility to online fraud. Such computers can also become inadvertent participants in or components of an online crime network, spam network, and/or phishing network as well as be used as a part of a distributed denial-of-service attack. Mitigating the effects of and remediating the installations of malicious bots will make it more difficult for botnets to operate and could reduce the level of online crime on the Internet in general and/or on a particular Internet Service Provider's network. This document is not an Internet Standards Track specification; it is published for informational purposes.
Publication Date: 2012-03-01
Status Note: Informational
DOI: 10.17487/RFC6561
Link: https://doi.org/10.17487/RFC6561
Author(s): Jason Livingood
Nirmal Mody
Michael O'Reirdan
Keyword(s): ISP, Botnets, Malware

Latest version of IETF RFC 6561

Document Versions — IETF RFC 6561

▶ IETF RFC 6561 (2012-03-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Bibliographic Reference(s)

Vallentin, M., Whiteaker, J., and Y. Ben-David, "The Gh0st in the Shell: Network Security in the Himalayas", February 2010, < http://www.infowar-monitor.net/wp-content/ uploads/2010/02/cs294-28-paper.pdf >. EXTERNAL
Ahamad, M., Amster, D., Barret, M., Cross, T., Heron, G., Jackson, D., King, J., Lee, W., Naraine, R., Ollman, G., Ramsey, J., Schmidt, H., and P. Traynor, "Emerging Cyber Threats Report for 2009: Data, Mobility and Questions of Responsibility will Drive Cyber Threats in 2009 and Beyond", October 2008, < http://smartech.gatech.edu/ bitstream/1853/26301/1/CyberThreatsReport2009.pdf >. EXTERNAL
Nagaraja, S. and R. Anderson, "The snooping dragon: social-malware surveillance of the Tibetan movement", March 2009, < http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-746.pdf >. EXTERNAL
Sacco, A. and A. Ortega, "Persistent BIOS Infection", March 2009, < http://www.coresecurity.com/files/ attachments/Persistent_BIOS_Infection_CanSecWest09.pdf >. EXTERNAL
Alshech, E., "Cyberspace as a Combat Zone: The Phenomenon of Electronic Jihad", February 2007, < http:// www.memrijttm.org/content/en/report.htm?report=1822 >. EXTERNAL
Saafan, A., "Distributed Denial of Service Attacks: Explanation, Classification and Suggested Solutions", March 2009, <www.exploit-db.com/download_pdf/14738/>. EXTERNAL
Roesch, M., "Snort Home Page", March 2009, < http://www.snort.org/ >. EXTERNAL
Berinato, S., "Case Study: How a Bookmaker and a Whiz Kid Took On a DDOS-based Online Extortion Attack", May 2005, < http://www.csoonline.com/article/220336/ How_a_Bookmaker_and_a_Whiz_Kid_Took_On_a_DDOS_based_Online _Extortion_Attack >. EXTERNAL
Porras, P., Saidi, H., and V. Yegneswaran, "An Analysis of Conficker's Logic and Rendezvous Points", March 2009, < http://mtc.sri.com/Conficker/ >. EXTERNAL
Kanich, C., Kreibich, C., Levchenko, K., Enright, B., Voelker, G., Paxson, V., and S. Savage, "Spamalytics: An Empirical Analysis of Spam Marketing Conversion", October 2008, < http://www.icir.org/christian/publications/ 2008-ccs-spamalytics.pdf >. EXTERNAL
Evron, G., "Battling Botnets and Online Mobs: Estonia's Defense Efforts during the Internet War", 2008, < http:// journal.georgetown.edu/wp-content/uploads/9.1-Evron.pdf >. EXTERNAL
IETF RFC 1459 [Active*]
IETF RFC 2142 [Active*]
IETF RFC 3954 [Active*]
IETF RFC 5070 [Superseded*]
IETF RFC 5965 [Active*]
RFC6108 — RFC6108 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6561.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 6561, Recommendations for the Remediation of Bots in ISP Networks. Available at https://doi.org/10.17487/RFC6561

Snippet:

IETF RFC 6561, Recommendations for the Remediation of Bots in ISP Networks. Available at https://doi.org/10.17487/RFC6561

HTML (ISO 690 compliant)

Preview:

IETF RFC 6561, Recommendations for the Remediation of Bots in ISP Networks. Available at https://doi.org/10.17487/RFC6561

Snippet:

<span class="citation"><cite>IETF RFC 6561</cite>, Recommendations for the Remediation of Bots in ISP Networks. Available at <a href="https://doi.org/10.17487/RFC6561" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6561</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 6561, Recommendations for the Remediation of Bots in ISP Networks
doi: 10.17487/RFC6561
url: https://doi.org/10.17487/RFC6561

Snippet:

<li>
<cite id="bib-rfc6561">IETF RFC 6561</cite>, Recommendations for the Remediation of Bots in ISP Networks
<span class="doi">10.17487/RFC6561</span>
</li>

Referenced By

IETF RFC 7719 [Superseded*]
IETF RFC 8499 [Superseded*]
IETF RFC 9499 [Active*]