Identifying botnets by capturing group activities in DNS traffic

Computer Networks

Volumn 56, Issue 1, 2012, Pages 20-33

  Choi, Hyunsang ^a   Lee, Heejo ^a  

^a Korea University   (South Korea)

Author keywords

Botnet; DNS; Group activity

Indexed keywords

BOTNET; BOTNETS; CAMPUS NETWORK; DNS; ENCRYPTED COMMUNICATION; FUNDAMENTAL CHARACTERISTICS; GROUP ACTIVITIES; IDENTITY THEFT; LARGE-SCALE NETWORK; LIGHT WEIGHT; NETWORK TRAFFIC; PHISHING; REAL TIME MONITORING;

COMPUTER CRIME; CRIME; DETECTORS;

INTERNET PROTOCOLS;

EID: 84655163180     PISSN: 13891286     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comnet.2011.07.018     Document Type: Article

References (55)

1. H. Choi, H. Lee, H. Lee, H. Kim, Botnet Detection by monitoring group activities in dns traffic, in: Proceedings of the IEEE International Conference on Computer and Information Technology (CIT), 2007.
2. H. Choi, H. Lee, H. Kim, BotGAD: detecting botnets by capturing group activities in network traffic, in: Proceedings of International Conference on COMmunication System softWAre and MiddlewaRE (COMSWARE), 2009.
3. S. Shevchenko, Kraken changes tactics. , 2009.
4. J. Wolf, Technical details of Srizbi's domain generation algorithm. , 2008.
5. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, G. Vigna, Your Botnet is My Botnet: Analysis of a Botnet Takeover, 2009.
6. P. Porras, H. Saidi, V. Yegneswaran, A foray into Conficker's logic and rendezvous points, in: Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2009.
7. A. Wald Sequential tests of statistical hypotheses The Annals of Mathematical Statistics 1945 117 186
8. A. Ramachandran, N. Feamster, D. Dagon, Revealing botnet membership using DNSBL counter-intelligence, in: Proceedings of the Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI), 2006.
9. R.V.-Salomon, J.C. Brustoloni, Bayesian bot detection based on DNS traffic similarity, in: Proceedings of the ACM Symposium on Applied Computing (SAC), 2009.
10. K. Sato, K. Ishibashi, T. Toyono, N. Miyake, Extending black domain name list by using co-occurrence relation between dns queries, in: Proceedings of the workshop on Large-scale Exploits and Emergent Threats (LEET), 2010.
11. J. Brustoloni, N. Farnan, R. Villamarin-Salomon, D. Kyle, Efficient detection of bots in subscribers' computers, in: Proceedings of IEEE International Conference Communications (ICC), 2009.
12. G. Gu, P. Porras, V. Yegneswaran, M. Fong, W. Lee, BotHunter: detecting malware infection through ids-driven dialog correlation, in: Proceedings of the USENIX Security Symposium (Security), 2007.
13. A. Karasaridis, B. Rexroad, D. Hoeflin, Wide-scale botnet detection and characterization, in: Proceedings of the Workshop on Hot Topics in Understanding Botnets (HotBots), 2007.
14. W. Lu, M. Tavallaee, G. Rammidi, A.A. Ghorbani, BotCop: an online botnets traffic classifier, in: Proceedings of the Conference on Communication Networks and Services Research (CNSR), 2009.
15. X. Hu, M. Knyz, K.G. Shin, RB-Seeker: auto-detection of redirection botnets, in: Proceedings of the Annual Network and Distributed System Security Symposium (NDSS), 2009.
16. H.R. Zeidanloo, and A.B.A. Manaf Botnet Detection by Monitoring Similar Communication Patterns International Journal of Computer Science and Information Security (IJCSIS) 2010
17. A.M. Manasrah, A. Hasan, O.A. Abouabdalla, and S. Ramadass Detecting Botnet Activities Based on Abnormal DNS traffic International Journal of Computer Science and Information Security (IJCSIS) 2009
18. M. Reiter, T. Yen, Traffic aggregation for malware detection, in: Proceedings of the Conference on Detection of Intrusions and Malware and Vulnerability Assessment (DIMVA), 2008.
19. G. Gu, J. Zhang, W. Lee, BotSniffer: detecting botnet command and control channels in network traffic, in: Proceedings of the Annual Network and Distributed System Security Symposium (NDSS), 2008.
20. X. Yu, X. Dong, G. Yu, Y. Qin, D. Yue, Y. Zhao, Online botnet detection by continuous similarity monitoring, in: Proceedings of International Symposium Information Engineering and Electronic Commerce IEEC'09, 2009.
21. H. Husna, S. Phithakkitnukoon, S. Palla, R. Dantu, Behavior analysis of spam botnets, in: Proceedings of the International Conference on COMmunication System softWAre and MiddlewaRE (COMSWARE), 2008.
22. L. Zhuang, J. Dunagan, D.R. Simon, H.J. Wang, I. Osipkov, G. Hulten, J.D. Tygar, Characterizing botnets from email spam records, in: Proceedings of the workshop on Large-scale Exploits and Emergent Threats (LEET), 2008.
23. Z. Duan, P. Chen, F. Sanchez, Y. Dong, M. Stephenson, J. Barker, Detecting spam zombies by monitoring outgoing messages, in: Proceedings of the Annual IEEE Conference on Computer Communications (INFOCOM), 2009.
24. Y. Zhao, Y. Xie, F. Yu, Q. Ke, Y. Yu, Y. Chen, E. Gillum, Botgraph: Large scale spamming botnet detection, in: Proceedings of the USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2009.
25. M. Antonakakis, R. Perdisci, D. Dagon, W. Lee, N. Feamster, Building a dynamic reputation system for DNS, in: Proceedings of the USENIX Security Symposium (Security), 2010.
26. G. Gu, R. Perdisci, J. Zhang, W. Lee, BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection, in: Proceedings of the USENIX Security Symposium (Security), 2008.
27. X. Yu, X. Dong, G. Yu, Y. Qin, D. Yue, Data-adaptive clustering analysis for online botnet detection, in: Proceedings Third International Computational Science and Optimization (CSO) Joint Conference, 2010.
28. W. Lu, G. Rammidi, and A.A. Ghorbani Clustering botnet communication traffic based on n-gram feature selection Computer Communications 2010
29. S. Hao, N. Syed, N. Feamster, A.G. Gray, S. Krasser, Detecting spammers with snare: spatio-temporal network-level automatic reputation engine, in: Proceedings of the USENIX Security Symposium (Security), 2009.
30. E. Stinson, J.C. Mitchell, Towards systematic evaluation of the evadability of bot/botnet detection methods, in: Proceedings of the USENIX Workshop on Offensive Technologies (WOOT), 2008.
31. J. Grizzard, V.Sharma, C. Nunnery, B. Kang, D. Dagon, Peer-to-peer botnets: overview and case study, in: Proceedings of the Workshop on Hot Topics in Understanding Botnets (HotBots), 2007.
32. D. Dagon, G. Gu, C. Lee, W. Lee, A taxonomy of botnet structures, in: Proceedings of the Annual Computer Security Applications Conference (ACSAC), 2007.
33. L. Liu, S. Chen, G. Yan, Z. Zhang, BotTracer: execution-based bot-like malware detection, in: Proceedings of the Information Security Conference (ISC), 2008.
34. P. Vixie, S. Thomson, Y. Rekhter, J. Bound, Dynamic updates in the domain name system (DNS update). , 1997.
35. J. John, A. Moshchuk, S. Gribble, A. Krishnamurthy, Studying spamming botnets using botlab, in: Proceedings of the Usenix Symposium on Networked Systems Design and Implementation (NSDI), 2009.
36. K. Chiang, L. Lloyd, A case study of the rustock rootkit and spam bot, in: Proceedings of the Workshop on Hot Topics in Understanding Botnets (HotBots), 2007.
37. W. Yih, C. Meek., Learning vector representations for similarity measures, Technical Report MSR-TR-2010-139, Microsoft Research.
38. S. Gündüz, M.T. Özsu, A Poisson model for user accesses to web pages, in: ISCIS: Computer and Information Sciences, 2003.
39. G. Marsaglia, and L.-H. Tsay Matrices and the structure of random number sequences Linear Algebra and its Applications 67 1985 147 156
40. D. Dagon, C. Zou, W. Lee, Modeling botnet propagation using time zones, in: Proceedings of the Annual Network and Distributed System Security Symposium (NDSS), 2006.
41. D. Pelleg, A.W. Moore, X-means: extending k-means with efficient estimation of the number of clusters, in: Proceedings of the International Conference on Machine Learning (ICML), 2000.
42. J. Ma, L.K. Saul, S. Savage, G.M. Voelker, Beyond blacklists: learning to detect malicious web sites from suspicious URLs, in: KDD: Proceedings of the international conference on Knowledge Discovery and Data mining, 2009.
43. D.K. McGrath, M. Gupta, Behind Phishing: An Examination of Phisher Modi Operandi, in: LEET: Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008.
44. GeoIP API, MaxMind, LLC, Open source APIs and database for geological information. , 2002.
45. T. Holz, C. Gorecki, K. Rieck, F.C. Freiling, Detection and mitigation of fast-flux service networks, in: Proceedings of the Annual Network and Distributed System Security Symposium (NDSS), 2008.
46. Korea Information Security Agency (KISA), Botnet C&C server domain list, 2009.
47. DNS-BH, Malware Prevention through Domain Blocking (Black Hole DNS Sinkhole). , 2007.
48. Cyber-TA, SRI Honeynet and BotHunter Malware Analysis Automatic Summary Analysis Table. , 2005.
49. McAfee SiteAdvisor, Service for reporting the safety of web sites. , 2006.
50. WOT, Web of Trust Community-based safe surfing tool. , 2006.
51. Domaincrawler, Domain Information Services. , 2006.
52. T. Holz, M. Steiner, F. Dahl, E. Biersacky, F. Freiling, Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm, in: Proceedings of the Workshop on Large-scale Exploits and Emergent Threats (LEET), 2008.
53. S. Herona Working the botnet: how dynamic DNS is revitalising the zombie army Network Security 2007 2007 9 11
54. Y. Xie, F. Yu, K. Achan, E. Gillum, M. Goldszmidt, T. Wobber, How dynamic are ip addresses?, in: Proceedings of the ACM SIGCOMM Conference on Data communication (SIGCOMM), 2007.
55. M. Feily, A. Shahrestani, S. Ramadass, A survey of botnet and botnet detection, in: Proceedings of the Conference on Emerging Security Information, Systems, and Technologies, 2009.