Genetic-based real-time fast-flux service networks detection

Hui Tang Lin, Ying You Lin, Jui Wei Chiang

Research output: Contribution to journalArticle

12 Citations (Scopus)

Abstract

A new DNS technique called Fast-Flux Service Network (FFSN) has been employed by bot herders to hide malicious activities and extend the lifetime of malicious root servers. Although various methods have been proposed for detecting FFSNs, these mechanisms have low detection accuracy and protracted detection time. This study presents a novel detection scheme, designated as the Genetic-based ReAl-time DEtection (GRADE) system, to identify FFSNs in real time. GRADE differentiates between FFSNs and benign services by employing two new characteristics: the entropy of domains of preceding nodes for all A records and the standard deviation of round trip time to all A records. By applying genetic algorithms, GRADE is able to find the best strategy to detect current FFSN trends. Empirical results show GRADE has very high detection accuracy (∼98%) and gives results within a few seconds. It provides considerable improvement over existing reference schemes such Flux-Score [8], SSFD [13], and FFSD [14].

Original languageEnglish
Pages (from-to)501-513
Number of pages13
JournalComputer Networks
Volume57
Issue number2
DOIs
Publication statusPublished - 2013 Feb 4

    Fingerprint

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications

Cite this