C&C tracer: Botnet command and control behavior tracing

Conference Proceedings - IEEE International Conference on Systems, Man and Cybernetics

Volumn , Issue , 2011, Pages 1859-1864

  Tsai, Meng Han ^a   Chang, Kai Chi ^a   Lin, Chang Cheng ^a   Mao, Ching Hao ^a   Lee, Huey Ming ^b  

^a INSTITUTE FOR INFORMATION INDUSTRY   (Taiwan)

^b CHINESE CULTURE UNIVERSITY   (Taiwan)

Author keywords

behavior tracing; Botnet; command and control; domain name; network security

Indexed keywords

ACTIVE BEHAVIOR; BEHAVIOR TRACING; BOTNET; C-DOMAIN; COMMAND AND CONTROL; DOMAIN NAMES; FEATURE EXTRACTING; FEATURE GENERATION; ONLINE DOMAINS; REAL NETWORKS; REAL TIME; THREE COMPONENT;

COMMAND AND CONTROL SYSTEMS; CYBERNETICS; NETWORK SECURITY;

BEHAVIORAL RESEARCH;

EID: 83755182669     PISSN: 1062922X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICSMC.2011.6083942     Document Type: Conference Paper

References (16)

1. P. Burghouwt, M. Spruit and H. Sips, Detection of Botnet collusion by degree distribution of domains, In proceeding of 2010 International Conference for Internet Technology and Secured Transactions (ICITST), 2010.
2. D. Burke, A. Caglayan, D. Drapeau, G. Eaton and M. Toothaker, Real- Time Detection of Fast Flux Service Networks, in Proceeding of Cyber-security Applications & Technology Conference for Homeland Security (CATCH'09), 2009.
3. H. Choi, H. Kim, H. Lee and H. Lee, Botnet Detection by Monitoring Group Activities in DNS Traffic, in Proceeding of 7th IEEE International Conference on Computer and Information Technology (CIT'07), 2007.
4. W. W. Cohen, Fast effective rule induction, In Proceedings of the Twelfth International Conference on Machine Learning (ICML'95),1995.
5. D. Dagon and W. Lee, Global Internet Monitoring Using Passive DNS, in Proceeding of Cybersecurity Applications & Technology Conference For Homeland Security (CATCH'09), 2009.
6. G. Gu, J. Zhang and W. Lee, Tracking multiple C&C Botnets by analyzing DNS traffic, in Proceeding of 2010 6th IEEE Workshop on Secure Network Protocols (NPSec), 2010.
7. F. Giroire, J. Chandrashekar, N. Taft, E. Schooler and D. Papagiannaki, Exploiting Temporal Persistence to Detect Covert Botnet Channels, in Proceeding of 12th International Symposium on Recent Advances in Intrusion Detection(RAID'09), 2009.
8. G. Gu, V. Yegneswaran, P. Porras, J. Stoll and W. Lee, Active Botnet Probing to Identify Obscure Command and Control Channels, in Proceeding of 2009 Annual Computer Security Applications Conference (ACSAC'09), 2009.
9. J. Kwon, J. Lee, H. Lee and H.-J. Shin, Tracking multiple C&C Botnets by analyzing DNS traffic, in Proceeding of 2010 6th IEEE Workshop on Secure Network Protocols (NPSec), 2010.
10. C. Cortes and V. Vapnik, Support-vector networks, Machine Learning, Vol. 20, No. 3, pp. 273-297,1995.
11. R. Kohavi and F. Provost, Glossary of Terms, Editorial for the Special Issue on Applications of Machine Learning and the Knowledge Discovery Process, Vol. 30, pp. 271-274,1998.
12. RFC 1123, http://www.freesoft.org/CIE/RFC/1123/index.htm.
13. The Shadowserver Foundation, http://www.shadowserver.org/.
14. IP-to-ASN Mapping Service - Team-Cymru, http://www.team-cymru. org/Services/ip-to-asn.html.
15. K nearest neighbor, http://en.wikipedia.org/wiki/K-nearest-neighbor- algorithm.
16. DNSSEC, http://www.dnssec.net/.