DBod: Clustering and detecting DGA-based botnets using DNS traffic analysis

Tzy Shiah Wang, Hui Tang Lin, Wei Tsung Cheng, Chang Yu Chen

研究成果: Article同行評審

73 引文 斯高帕斯(Scopus)

摘要

Botnets are one of the leading threats to network security nowadays and are used to conduct a wide variety of malicious activities, including information theft, phishing, spam mail distribution, and Distributed Denial of Service (DDoS) attacks. Among the various forms of botnet, DGA-based botnets, which utilize a Domain Generation Algorithm (DGA) to avoid detection, are one of the most disruptive and difficult to detect. In such botnets, the DGA is used to generate a huge list of candidate Command and Control (C&C) server domains, and the bot then attempts to connect to an active C&C server by querying each DNS server in turn. DGA-based botnets are highly elusive and difficult to detect using traditional defensive mechanisms and therefore have a high survivability. Accordingly, this study proposes a DGA-based botnet detection scheme designated as DBod based on an analysis of the query behavior of the DNS traffic. The proposed scheme exploits the fact that hosts compromised by the same DGA-based malware query the same sets of domains in the domain list and most of these queries fail since only a very limited number of the domains are actually associated with an active C&C. The feasibility of the proposed method is evaluated using the DNS data collected from an education network environment over a period of 26 months. The results show that DBod provides an accurate and effective means of detecting both existing and new DGA-based botnet patterns in real-world networks.

原文English
頁(從 - 到)1-15
頁數15
期刊Computers and Security
64
DOIs
出版狀態Published - 2017 1月 1

All Science Journal Classification (ASJC) codes

  • 電腦科學(全部)
  • 法律

指紋

深入研究「DBod: Clustering and detecting DGA-based botnets using DNS traffic analysis」主題。共同形成了獨特的指紋。

引用此