.png){kind=icon}
.png){kind=icon}
Return
Detecting Algorithmically Generated Domain-Flux Attacks With DNS Traffic Analysis
.png){kind=icon}
PRE
AI
DOI：10.1109/TNET.2012.2184552.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Recent botnets such as Conficker, Kraken, and Torpig have used DNS-based domain fluxing for command-and-control, where each Bot queries for existence of a series of domain names and the owner has to register only one such domain name. In this paper, we develop a methodology to detect such domain fluxes in DNS traffic by looking for patterns inherent to domain names that are generated algorithmically, in contrast to those generated by humans. In particular, we look at distribution of alphanumeric characters as well as bigrams in all domains that are mapped to the same set of IP addresses. We present and compare the performance of several distance metrics, including K-L distance, Edit distance, and Jaccard measure. We train by using a good dataset of domains obtained via a crawl of domains mapped to all IPv4 address space and modeling bad datasets based on behaviors seen so far and expected. We also apply our methodology to packet traces collected at a Tier-1 ISP and show we can automatically detect domain fluxing as used by Conficker botnet with minimal false positives, in addition to discovering a new botnet within the ISP trace. We also analyze a campus DNS trace to detect another unknown botnet exhibiting advanced domain-name generation technique.
Keywords:
Components
domain flux
domain names
Edit distance
entropy
IP fast flux
Jaccard index
malicious
Journal
I
IF:
3.6
Papers:
4.4K
Citations:
9.5K