Yadav, Sandeep and Kumar Reddy, Ashwath and Narasimha Reddy, A.L. and Ranjan, Supranamaya (2010) Detecting algorithmically generated malicious domain names. In: Internet Measurement Conference 2010, 1-3 November 2010, Melbourne, Australia.
![]()
|
PDF
- Published Version
Download (278Kb) | Preview |
Abstract
Recent Botnets such as Conficker, Kraken and Torpig have used DNS based “domain fluxing” for command-and-control, where each Bot queries for existence of a series of domain names and the owner has to register only one such domain name. In this paper, we develop a methodology to detect such “domain fluxes” in DNS traffic by looking for patterns inherent to domain names that are generated algorithmically, in contrast to those generated by humans. In particular, we look at distribution of alphanumeric characters as well as bigrams in all domains that are mapped to the same set of IP-addresses. We present and compare the performance of several distance metrics, including KL-distance, Edit distance and Jaccard measure. We train by using a good data set of domains obtained via a crawl of domains mapped to all IPv4 address space and modeling bad data sets based on behaviors seen so far and expected. We also apply our methodology to packet traces collected at a Tier-1 ISP and show we can automatically detect domain fluxing as used by Conficker botnet with minimal false positives
Item Type: | Conference or Workshop Papers (Paper) |
---|---|
Subjects: | Q Science > Q Science (General) Q Science > QA Mathematics > QA75 Electronic computers. Computer science T Technology > T Technology (General) T Technology > TA Engineering (General). Civil engineering (General) T Technology > TK Electrical engineering. Electronics Nuclear engineering |
Divisions: | Faculty of Engineering, Science and Mathematics > School of Electronics and Computer Science |
Depositing User: | Acosta Angel |
Date Deposited: | 14 Feb 2012 16:09 |
Last Modified: | 28 Apr 2014 09:52 |
URI: | http://eprints.networks.imdea.org/id/eprint/67 |
Actions (login required)
![]() |
View Item |