IMDEA Networks Institute Publications Repository

Detecting algorithmically generated malicious domain names

Yadav, Sandeep and Kumar Reddy, Ashwath and Narasimha Reddy, A.L. and Ranjan, Supranamaya (2010) Detecting algorithmically generated malicious domain names. In: Internet Measurement Conference 2010, 1-3 November 2010, Melbourne, Australia.

[img]
Preview
PDF - Published Version
Download (278Kb) | Preview

Abstract

Recent Botnets such as Conficker, Kraken and Torpig have used DNS based “domain fluxing” for command-and-control, where each Bot queries for existence of a series of domain names and the owner has to register only one such domain name. In this paper, we develop a methodology to detect such “domain fluxes” in DNS traffic by looking for patterns inherent to domain names that are generated algorithmically, in contrast to those generated by humans. In particular, we look at distribution of alphanumeric characters as well as bigrams in all domains that are mapped to the same set of IP-addresses. We present and compare the performance of several distance metrics, including KL-distance, Edit distance and Jaccard measure. We train by using a good data set of domains obtained via a crawl of domains mapped to all IPv4 address space and modeling bad data sets based on behaviors seen so far and expected. We also apply our methodology to packet traces collected at a Tier-1 ISP and show we can automatically detect domain fluxing as used by Conficker botnet with minimal false positives

Item Type: Conference or Workshop Papers (Paper)
Subjects: Q Science > Q Science (General)
Q Science > QA Mathematics > QA75 Electronic computers. Computer science
T Technology > T Technology (General)
T Technology > TA Engineering (General). Civil engineering (General)
T Technology > TK Electrical engineering. Electronics Nuclear engineering
Divisions: Faculty of Engineering, Science and Mathematics > School of Electronics and Computer Science
Depositing User: Acosta Angel
Date Deposited: 14 Feb 2012 16:09
Last Modified: 28 Apr 2014 09:52
URI: http://eprints.networks.imdea.org/id/eprint/67

Actions (login required)

View Item View Item