Good guys vs. Bot Guise: Mimicry attacks against fast-flux detection systems

Proceedings - IEEE INFOCOM

Volumn , Issue , 2011, Pages 1844-1852

  Knysz, Matthew ^a   Hu, Xin ^a   Shin, Kang G ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNETS; DETECTION SYSTEM; FORMAL MODEL;

DETECTORS;

EID: 79960855165     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2011.5934985     Document Type: Conference Paper

References (11)

1. Andreas Willig. A short introduction to queueing theory. http://www.tkn.tu-berlin.de/curricula/ws0203/ue-kn/qt.pdf, 1999.
2. T. Holz, C. Gorecki, K. Rieck, and F. C. Freiling. Measuring and detectin fast-flux service networks. In Proc. of network and Distributed System Security (NDSS) Symposium, 2008.
3. X. Hu, M. Knysz, and K. G. Shin. RB-Seeker: Auto-detection of Redirection Botnets. In Proceedings of the NDSS'09, 2009.
4. S.-Y. Huang, C.-H. Mao, and H.-M. Lee. Fast-flux service network detection based on spatial snapshot mechanism for delay-free detection. In Proceedings of the 5th ASIACCS, 2010.
5. C. Kruegel, E. Kirda, D. Mutz, W. Robertson, and G. Vigna. Automating mimicry attacks using static binary analysis. In In USENIX Security Symposium, 2005.
6. P. Mockapetris. Domain names - implementation and specification. RFC 1035, 1987.
7. C. Parampalli, R. Sekar, and R. Johnson. A practical mimicry attack against powerful system-call monitors. In Proceedings of the 3rd ASIACCS, 2008.
8. E. Passerini, R. Paleari, L. Martignoni, and D. Bruschi. FluXOR: detecting and monitoring fast-flux service networks. In Proceedings of DIMVA'08, 2008.
9. R. Perdisci, I. Corona, D. Dagon, and W. Lee. Detecting malicious flux service networks through passive analysis of recursive dns traces. In Proceedings of ACSAC '09, 2009.
10. Planetlab. An open platform for developing, deploying and accessing planetary-scale services. http://www.planet-lab.org/.
11. D. Wagner and P. Soto. Mimicry attacks on host-based intrusion detection systems. In Proceedings of the 9th ACM CCS, 2002.