The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.05 - Sept.-Oct. (2012 vol.9)
pp: 714-726
Roberto Perdisci , University of Georgia, Athens
Igino Corona , University of Cagliari, Cagliari
Giorgio Giacinto , University of Cagliari, Cagliari
ABSTRACT
In this paper, we present FluxBuster, a novel passive DNS traffic analysis system for detecting and tracking malicious flux networks. FluxBuster applies large-scale monitoring of DNS traffic traces generated by recursive DNS (RDNS) servers located in hundreds of different networks scattered across several different geographical locations. Unlike most previous work, our detection approach is not limited to the analysis of suspicious domain names extracted from spam emails or precompiled domain blacklists. Instead, FluxBuster is able to detect malicious flux service networks in-the-wild, i.e., as they are "accessed” by users who fall victim of malicious content, independently of how this malicious content was advertised. We performed a long-term evaluation of our system spanning a period of about five months. The experimental results show that FluxBuster is able to accurately detect malicious flux networks with a low false positive rate. Furthermore, we show that in many cases FluxBuster is able to detect malicious flux domains several days or even weeks before they appear in public domain blacklists.
INDEX TERMS
IP networks, Electronic mail, Servers, Monitoring, Security, Indexes, Internet, Internet security., Flux networks, DNS, passive traffic analysis, clustering, classification
CITATION
Roberto Perdisci, Igino Corona, Giorgio Giacinto, "Early Detection of Malicious Flux Networks via Large-Scale Passive DNS Traffic Analysis", IEEE Transactions on Dependable and Secure Computing, vol.9, no. 5, pp. 714-726, Sept.-Oct. 2012, doi:10.1109/TDSC.2012.35
REFERENCES
[1] SSAC, "SAC 025 - SSAC Advisory on Fast Flux Hosting and DNS," http://www.icann.org/en/committees/security sac025. pdf, 2008.
[2] The Honeynet Project, "Know Your Enemy: Fast-Flux Service Networks," http://old.honeynet.org/papers/fffast-flux.html , 2007.
[3] T. Holz, C. Gorecki, K. Rieck, and F. Freiling, "Measuring and Detecting Fast-Flux Service Networks," Proc. Network and Distributed System Security Symp. (NDSS '08), 2008.
[4] E. Passerini, R. Paleari, L. Martignoni, and D. Bruschi, "Fluxor: Detecting and Monitoring Fast-Flux Service Networks," Proc. Fifth Int'l Conf. Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA '08), 2008.
[5] J. Nazario and T. Holz, "As the Net Churns: Fast-Flux Botnet Observations," Proc. Third Int'l Conf. Malicious and Unwanted Software (MALWARE '08), 2008.
[6] M. Konte, N. Feamster, and J. Jung, "Dynamics of Online Scam Hosting Infrastructure," Proc. Passive and Active Measurement Conf. (PAM '09), 2009.
[7] R. Perdisci, I. Corona, D. Dagon, and W. Lee, "Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS Traces," Proc. Ann. Computer Security Applications Conf. (ACSAC), 2009.
[8] "ISC Security Information Exchange," https:/sie.isc.org, 2012.
[9] X. Hu, M. Knysz, and K.G. Shin, "RB-Seeker: Auto-Detection of Redirection Botnets," Proc. Ann. Network and Distributed System Security Symp. (NDSS), 2009.
[10] C.-H. Hsu, C.-Y. Huang, and K.-T. Chen, "Fast-Flux Bot Detection in Real Time," Proc. 13th Int'l Conf. Recent Advances in Intrusion Detection (RAID '10), 2010.
[11] M. Antonakakis, R. Perdisci, D. Dagon, W. Lee, and N. Feamster, "Building a Dynamic Reputation System for dns," Proc. 19th USENIX Conf. Security, 2010.
[12] L. Bilge, E. Kirda, C. Kruegel, and M. Balduzzi, "Building a Dynamic Reputation System for DNS," Proc. 18th Ann. Network and Distributed System Security Symp. (NDSS), 2011.
[13] M. Antonakakis, R. Perdisci, W. Lee, N. Vasiloglou, and D. Dagon, "Detecting Malware Domains at the Upper DNS Hierarchy," Proc. 20th USENIX Conf. Security, 2011.
[14] A.K. Jain and R.C. Dubes, Algorithms for Clustering Data. Prentice-Hall, Inc., 1988.
[15] A.K. Jain, M.N. Murty, and P.J. Flynn, "Data Clustering: A Review," ACM Computing Surveys, vol. 31, no. 3, pp. 264-323, 1999.
[16] R. Dugad and N. Ahuja, "Unsupervised Multidimensional Hierarchical Clustering," Proc. IEEE Int'l Conf. Acoustics, Speech and Signal Processing, 1998.
[17] J.R. Quinlan, C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers, 1993.
[18] "Zeus Tracker," https:/zeustracker.abuse.ch/, 2012.
[19] B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna, "Your Botnet is My Botnet: Analysis of a Botnet Takeover," Proc. ACM Conf. Computer and Comm. Security, 2009.
[20] M. Knysz, X. Hu, and K.G. Shin, "Good Guys vs. Bot Guise: Mimicry Attacks against Fast-Flux Detection Systems," Proc. IEEE INFOCOM, 2011.
28 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool