Winning with DNS failures: Strategies for faster botnet detection

Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering

Volumn 96 LNICST, Issue , 2012, Pages 446-459

  Yadav, Sandeep ^a   Reddy, A L Narasimha ^a  

^a Department of Electrical and Computer Engineering   (United States)

Author keywords

Botnet; DNS; Domain fluxing; Failures

Indexed keywords

AUTONOMOUS SYSTEMS; BOTNET; BOTNETS; COMMAND AND CONTROL; DATA SETS; DNS; DOMAIN-FLUXING; FALSE POSITIVE RATES; INFORMATION ENTROPY; REAL-TIME DETECTION; SERVER ADDRESS; SOUTH ASIA; TEMPORAL CORRELATIONS;

COMMAND AND CONTROL SYSTEMS; FAILURE (MECHANICAL);

INTERNET PROTOCOLS;

EID: 84869596872     PISSN: 18678211     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-3-642-31909-9_26     Document Type: Conference Paper

References (13)

1. Conficker Working Group, http://www.confickerworkinggroup.org/wiki/ pmwiki.php/ANY/FAQ#toc5
2. New Technique Spots Sneaky Botnets, http://mobile.darkreading.com/9292/ show/4711c9403b772e7281ae08cee69758cc&t=461a4a89abc0a0c761234d11086f5003
3. Gu, G., Porras, P., Yegneswaran, V., Fong, M., Lee, W.: BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation. In: Proc. of the 16th USENIX Security Symposium (Security 2007) (August 2007)
4. Jiang, N., Cao, J., Jin, Y., Li, L.E., Zhang, Z.-L.: Identifying Suspicious Activities Through DNS Failure Graph Analysis. In: IEEE Conference on Network Protocols (2010)
5. Manning, C.D., Raghavan, P., Schutze, H.: An Information to Information Retrieval. Cambridge University Press (2009)
6. Porras, P., Saidi, H., Yegneswaran, V.: Conficker C Analysis. Technical report, http://mtc.sri.com/Conficker/addendumC/
7. Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G., Lear, E.: Address Allocation for Private Internets (1996), http://www.ietf.org/rfc/ rfc1918.txt
8. Stone-Gross, B., Cova, M., Cavallaro, L., Gilbert, B., Szydlowski, M., Kemmerer, R., Kruegel, C., Vigna, G.: Your Botnet is My Botnet: Analysis of a Botnet Takeover. In: ACM Conference on Computer and Communications Security (CCS) (November 2009)
9. Villamarín-Salomón, R., Brustoloni, J.C.: Identifying Botnets Using Anomaly Detection Techniques Applied to DNS Traffic. In: Consumer Communications and Networking Conference (2008)
10. Villamarín-Salomón, R., Brustoloni, J.C.: Bayesian Bot Detection Based on DNS Traffic Similarity. In: Proceedings of the 2009 ACMSymposium on Applied Computing, SAC 2009, pp. 2035-2041. ACM, New York (2009)
11. Yadav, S., Reddy, A.K.K., Reddy, A.L.N., Ranjan, S.: Detecting Algorithmically Generated Malicious Domain Names. In: Internet Measurement Conference (2010)
12. Yadav, S., Reddy, A.N.: MiND: Misdirected dNs packet Detector. In: IASTED Computer and Information Security (2010)
13. Zhu, Z., Yegneswaran, V., Chen, Y.: Using Failure Information Analysis to Detect Enterprise Zombies. In: Chen, Y., Dimitriou, T.D., Zhou, J. (eds.) SecureComm 2009. LNICST, vol. 19, pp. 185-206. Springer, Heidelberg (2009)