vRRitti.com, providing sentiency

In the period under study, January 2009 to June 2010, we identified around 1.1 million IP addresses that indicated the presence of an infected machine in the Netherlands. Around 900,000 of those were located in the networks of the main Dutch ISPs. This can be conservatively interpreted as 450,000 to 900,000 infected machines.

To put it differently: During 2009, between 5-10 percent of all Dutch broadband subscribers have suffered an infection that made their machine part of a botnet. The data for the first half of 2010 suggests this pattern will hold or get worse for 2010.

In reality, the number of infected machines in the Netherlands is probably significantly larger than our estimates suggest. This is because only a fraction of the infected machines we identified show up in more than one dataset. In other words, there is only a small overlap among the datasets. This suggests that if we would include additional datasets, the number of infected machines we would identify in the Netherlands is likely to be substantially higher.

Dutch ISPs contact around 10 percent of the total number of infected customers in their networks. This low ratio has two main explanations: (1) the ISPs lack intelligence on infected machines – their own data feeds capture much less than the datasets used in the study; (2) ISPs need to be careful to avoid false positives when deciding whether to contact or quarantine a customer, so they cannot act on every single piece of data.

The extent to which the mitigation process is automated – contacting infected customers and, when needed, limiting or quarantining their connection – has a direct impact on the number of customers that are contacted or quarantined. Automation drives down the costs of mitigation.

we also have to acknowledge that ISPs can play a crucial role and that the economic incentives under which they operate will make them reluctant to take on that role. As earlier studies reported, most of the damage of botnets are borne by other actors than the owners of the infected machines or the ISPs that connect them to the Internet.24 Since they do not suffer the full extent of this damage, ISPs and their customers do not have the economic incentives to invest in mitigation at the level that is socially desirable. The cost of mitigation will therefore be a major factor in influencing how much ISPs are willing and able to do in this area

In light of the costs of acquiring and processing this data for use in the mitigation efforts of the abuse departments, it seems worthwhile to explore whether this effort could be pursued collectively. It may be possible to achieve economies of scale by building one platform for all ISPs, rather than each ISP building a platform on its own. A centralized, shared clearinghouse might be an efficient way to drastically improve the intelligence that ISPs are using to protect their networks and customers against modest cost.

Much more: http://www.rijksoverheid.nl/bestanden/documenten-en-publicaties/rapporten/2011/01/13/internet-service-providers-and-botnet-mitigation/tud-isps-and-botnet-mitigation-in-nl-final-public-version-07jan2011.pdf