The Role of Internet Service Providers in Botnet Mitigation

We studied how Internet Service Providers (ISPs) are involved in botnet mitigation in the Netherlands. Although Dutch ISPs on average perform very well with respect to botnet mitigation, botnets still are a significant threat and many end-user systems are infected by bot-malware. We created a reference model which summarizes measures for botnet mitigation from scientific literature that ISPs can take. Our model is structured according to the five stages in the anti-botnet lifecycle: prevention, detection, notification, remediation, and recovery. We validated our reference model in an empirical study by means of semi-structured interviews with a representative sample of Dutch ISPs. Our study identified which measures actually have been taken by ISPs, and why other measures have not been taken (yet). It became clear that ISPs spend most effort on prevention and notification towards customers, thereby focusing on individual bots. ISPs currently have little incentive to implement further measures for detection, remediation, and recovery. Although ISPs are well capable of applying advanced detection and follow up actions, they do not apply such measures mainly due to privacy concerns of customer data. Furthermore, although ISPs do cooperate in various ways, there still is room for improvement, particularly in the sharing of information on botnet infections and mitigation practices with stakeholders and peer ISPs.