Cyber Defense Agency, LLC (CDA) proposes to develop StopBot, a unique, multi-modal security application that will detect botnets and disable their command and control systems. StopBot will have three different modes of operation: a free, stand-alone mode to protect individual end systems, a subscription mode in which results from individual end systems are collected securely and correlated to generate more effective detection and response mechanisms that can be distributed to the end system subscribers, and an enterprise mode that trades privacy for enhanced detection capabilities. StopBot will meditate communications from computers on a network, detect suspicious connections, correlate the signatures of those connections to identify botnets, block traffic on those connections, and inject dummy messages that will disrupt the botnet command-and-control infrastructure. Placing the primary sensor inline on each host provides a means to detect features indicative of bots, and correlating across the enterprise affords an excellent means to identify networks of bots. As a stand-alone component the StopBot client will effectively inhibit the ability to use its host as a host for bots. It will be available as a free download from the CDA web-site. CDA will maintain the correlation, fusion, and response capability and will use it as a basis of a for pay subscription service.
