Detecting malware domains at the upper DNS hierarchy

Proceedings of the 20th USENIX Security Symposium

Volumn , Issue , 2011, Pages 411-426

  Antonakakis, Manos ^a,b   Perdisci, Roberto ^c   Lee, Wenke ^b   Vasiloglou Ii, Nikolaos ^a   Dagon, David ^b  

^a Damballa Inc   (United States)

^b Georgia Institute of Technology   (United States)

^c Department of Computer Science ^*  (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMMAND AND CONTROL SYSTEMS; INTERNET PROTOCOLS;

COMMAND AND CONTROL; FALSE POSITIVE RATES; GLOBAL VISIBILITY; HIGH DETECTION RATE; MONITORING NETWORK; NETWORK INFRASTRUCTURE; PROOF OF CONCEPT; REPUTATION SYSTEMS;

MALWARE;

EID: 85068675731     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (31)

1. M. Abu Rajab, J. Zarfoss, F. Monrose, and A. Terzis. A multifaceted approach to understanding the botnet phenomenon. In Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, IMC '06, 2006.
2. Alexa. The web information company. http://www. alexa.com/, 2007.
3. M. Antonakakis, R. Perdisci, D. Dagon, W. Lee, and N. Feamster. Building a Dynamic Reputation System for DNS. In the Proceedings of 19th USENIX Security Symposium (USENIX Security '10), 2010.
4. L. Bilge, E. Kirda, C. Kruegel, and M. Balduzzi. Exposure: Finding malicious domains using passive dns analysis. In Proceedings of NDSS, 2011.
5. C. M. Bishop. Pattern Recognition and Machine Learning (Information Science and Statistics). Springer-Verlag New York, Inc., Secaucus, NJ, USA, 2006.
6. M. P. Collins, T. J. Shimeall, S. Faber, J. Janies, R. Weaver, M. De Shon, and J. Kadane. Using uncleanliness to predict future botnet addresses. In Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, IMC '07, pages 93-104, New York, NY, USA, 2007. ACM.
7. D. Dagon, C. Zou, and W. Lee. Modeling botnet propagation using time zones. In In Proceedings of the 13 th Network and Distributed System Security Symposium NDSS, 2006.
8. dihe's IP-Index Browser. DIHE. http://ipindex. homelinux.net/index.php, 2008.
9. DNS Whitelist Protect against false positives. DNSWL. http://www.dnswl.org, 2008.
10. R. Duda, P. Hart, and D. Stork. Pattern Classification. Wiley-Interscience, 2nd edition, 2000.
11. M. Felegyhazi, C. Keibich, and V. Paxson. On the poten- tial of proactive domain blacklisting. In Third USENIX LEET Workshop, 2010.
12. P. Fogla, M. Sharif, R. Perdisci, O. Kolesnikov, and W. Lee. Polymorphic blending attacks. In In Proceedings of the 15 th USENIX Security Symposium, pages 241-256, 2006.
13. S. Hao, N. Feamster, and R. Pandrangi. An Internet Wide View into DNS Lookup Patterns. http://labs.verisigninc.com/projects/ malicious-domain-names.html, 2010.
14. T. Hastie, R. Tibshirani, and J. Friedman. The Elements of Statistical Learning. Springer Series in Statistics. Springer New York Inc., New York, NY, USA, 2001.
15. J. Jung, E. Sit, H. Balakrishnan, and R. Morris. DNS performance and the effectiveness of caching. IEEE/ACM Trans. Netw., 10:589-603, October 2002.
16. MalwareDomains. DNS-BH malware domain blocklist. http://www.malwaredomains.com, 2007.
17. P. Mockapetris. Domain Names - Concepts and Facilities. http://www.ietf.org/rfc/rfc1034. txt, 1987.
18. P. Mockapetris. Domain Names - Implementation and Specification. http://www.ietf.org/rfc/ rfc1035.txt, 1987.
19. OPENDNS. OpenDNS - Internet Navigation And Security. http://www.opendns.com/, 2010.
20. P. Porras. Inside risks: Reflections on conficker. Commun. ACM, 52:23-24, October 2009.
21. R. Perdisci, I. Corona, D. Dagon, and W. Lee. Detecting malicious flux service networks through passive analysis of recursive DNS traces. In Proceedings of ACSAC, Honolulu, Hawaii, USA, 2009.
22. SBL. The Spamhaus Project Block List. http://www. spamhaus.org/sbl/, 2004.
23. S. Shevchenko. Domain Name Generator for Murofet. http://blog.threatexpert.com/2010/10/ domain-name-generator-for-murofet. html, 2010.
24. SIE@ISC. Internet Systems Consortium: Security Information Exchange. https://sie.isc.org/, 2004.
25. S. Staniford, V. Paxson, and N. Weaver. How to own the internet in your spare time. In Proceedings of the 11th USENIX Security Symposium, pages 149-167, Berkeley, CA, USA, 2002. USENIX Association.
26. J. Stewart. Bobax trojan analysis. http: //www.secureworks.com/research/ threats/bobax/, 2004.
27. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna. Your botnet is my botnet: Analysis of a botnet takeover. In Proceedings of the 16th ACM conference on Computer and communications security, CCS '09, pages 635-647, New York, NY, USA, 2009. ACM.
28. Team Cymru. IP to ASN mapping. http: //www.team-cymru.org/Services/ ip-to-asn.html, 2008.
29. N.Weaver, S. Staniford, and V. Paxson. Very fast containment of scanning worms. In In Proceedings of the 13th USENIX Security Symposium, pages 29-44, 2004.
30. D. Wessels, M. Fomenkov, N. Brownlee, and K. Claffy. Measurements and Laboratory Simulations of the Upper DNS Hierarchy. In PAM, 2004.
31. Zeus Tracker. Zeus IP & domain name block list. https://zeustracker.abuse.ch, 2009.