A framework for DNS based detection and mitigation of malware infections on a network

2011 Information Security for South Africa - Proceedings of the ISSA 2011 Conference

Volumn , Issue , 2011, Pages

  Stalmans, Etienne ^a   Irwin, Barry ^a  

^a RHODES UNIVERSITY   (South Africa)

Author keywords

Botnets; Domain Name Service; Security; Security Framework

Indexed keywords

BAYESIAN STATISTICS; BOTNETS; DECISION TREE CLASSIFIERS; DETECTION SYSTEM; DETECTION TECHNIQUE; DOMAIN NAME SERVICE; DOMAIN NAMES; FALSE POSITIVE RATES; HIGH DEGREE OF ACCURACY; INTRUSION DETECTION SYSTEMS; MALICIOUS TRAFFIC; MALWARES; MULTIPLE DOMAINS; NAIVE BAYESIAN; NETWORK ACTIVITIES; NETWORK EDGES; SECURITY; SECURITY FRAMEWORKS; TOTAL VARIATION;

CHEMICAL DETECTION; COMPUTER CRIME; DECISION TREES; FACE RECOGNITION; INTERNET PROTOCOLS; NETWORK PROTOCOLS; NETWORK SECURITY; PROBABILITY DISTRIBUTIONS;

INTRUSION DETECTION;

EID: 80053943682     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ISSA.2011.6027531     Document Type: Conference Paper

References (25)

1. R. Bejtlich, Extrusion Detection: security monitoring for internal intrusions. Addison-Wesley, 2005.
2. V. P. André Fucs, Augusto Paes de Barros, "New botnets trends and threats," in Blackhat Europe, 2007.
3. G. Gu, J. Zhang, and W. Lee, "Botsniffer : Detecting botnet command and control channels in network traffic," Technology.
4. S. Yadav, A. K. K. Reddy, A. N. Reddy, and S. Ranjan, "Detecting algorithmically generated malicious domain names," in Proceedings of the 10th annual conference on Internet measurement - IMC '10, New York, New York, USA, November 2010, p. 48.
5. P. Porras, H. Saidi, and V. Yegnewaran, "Conficker c analysis," Tech. Rep., 2009.
6. F. Leder and T.Werner. (2011) Containing conficker. [Online]. Available: http://net.cs.uni-bonn.de/uploads/media/c-domains-april2009.zip
7. R. Perdisci, I. Corona, D. Dagon, and W. Lee, "Detecting malicious flux service networks through passive analysis of recursive DNS traces," 2009 Annual Computer Security Applications Conference, pp. 311-320, December 2009.
8. T. Holz, C. Gorecki, K. Rieck, and F. C. Freiling, "Measuring and detecting fast-flux service networks," in MALWARE 2008. 3rd International Conference on Malicious and Unwanted Software, 2008, 2008, pp. 24-31.
9. Dragon Research Group. (2011) Team cymru. [Online]. Available: http://www.team-cymru.org/Services/ip-to-asn.html
10. H. Xiong, P. Malhotra, D. Stefan, C. Wu, and D. Yao, "User-assisted host-based detection of outbound malware traffic," University Computing.
11. G. Gu, R. Perdisci, J. Zhang, and W. Lee, "Botminer: clustering analysis of network traffic for protocol- and structure-independent botnet detection," in Proceedings of the 17th conference on Security symposium, 2008, pp. 139-154.
12. N. Jiang, J. Cao, Y. Jin, L. E. Li, and Z.-l. Zhang, "Identifying suspicious activities through DNS failure graph analysis," in IEEE International Conference on Network Protocols (IEEE ICNP'10), 2010, pp. 144-153.
13. J. Ma, L. K. Saul, S. Savage, and G. M. Voelker, "Beyond blacklists : Learning to detect malicious web sites from suspicious urls," World Wide Web Internet And Web Information Systems, 2009.
14. Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and I. Osipkov, "Spamming botnets: Signatures and characteristics," in ACM SIGCOMM Computer Communication Review, 2008.
15. J. Zhang, X. Luo, R. Perdisci, G. Gu, W. Lee, and N. Feamster, "Boosting the scalability of botnet detection using adaptive traffic sampling," in Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security. ACM, 2011, pp. 124-134.
16. M. Sahami, S. Dumais, D. Heckerman, and E. Horvitz, "A bayesian approach to filtering junk e-mail," in AAAI'98 Workshop on Learning for Text Categorization, 1998.
17. R. Perdisci, G. Giacinto, and F. Roli, "Alarm clustering for intrusion detection systems in computer networks," Engineering Applications of Artificial Intelligence, vol. 19, no. 4, pp. 429-438, June 2006.
18. Google. (2011) Top 1000 sites - doubleclick ad planner. [Online]. Available: http://www.google.com/adplanner/static/top1000/
19. abuse.ch. (2011) Zeus monitor. [Online]. Available: https://zeustracker. abuse.ch/monitor.php?filter=level5
20. -. (2011) Spyeye monitor. [Online]. Available: https://spyeyetracker. abuse.ch/monitor.php?filter=level5
21. -. (2011) Fastflux tracker. [Online]. Available: http://dnsbl.abuse.ch/ fastfluxtracker.php
22. P. Royal. (2008) On the kraken and bobax botnets. [Online]. Available: http://www.damballa.com/downloads/r-pubs/Kraken-Response.pdf
23. MalwareURL. (2011) Malwareurl. [Online]. Available: http://www. malwareurl.com/
24. Rulequest Research. (2011) See5/c5.0. [Online]. Available: http://www.rulequest.com/see5-info.html
25. P. S. David Hand, Heikki Mannila, Principles of Data Mining. The MIT Press, 2001.