DNS Query Failure and Algorithmically Generated Domain-Flux Detection

Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F14%3A00080502" target="_blank" >RIV/00216224:14330/14:00080502 - isvavai.cz</a>
Result on the web
<a href="http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7141236&newsearch=true&searchWithin=%22First%20Name%22:Ibrahim&searchWithin=%22Last%20Name%22:Ghafir" target="_blank" >http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7141236&newsearch=true&searchWithin=%22First%20Name%22:Ibrahim&searchWithin=%22Last%20Name%22:Ghafir</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1049/cp.2014.1410" target="_blank" >10.1049/cp.2014.1410</a>

Result language
angličtina
Original language name
DNS Query Failure and Algorithmically Generated Domain-Flux Detection
Original language description
Botnets are now recognized as one of the most serious security threats. Recent botnets such as Conficker, Murofet and BankPatch have used domain flux technique to connect to their command and control (CaC) servers, where each Bot queries for existence ofa series of domain names used as rendezvous points with their controllers while the owner has to register only one such domain name. The large number of potential rendezvous points makes it difficult for law enforcement to effectively shut down botnets.In this paper we present our methodology for detecting algorithmically generated domain flux. Our detection method is based on DNS query failures resulting from domain flux technique. We process the network traffic, particularly DNS traffic. We analyzeall DNS query failures and propose a threshold for DNS query failures from the same IP address.
Czech name
—
Czech description
—

Project
<a href="/en/project/OFMASUN201301" target="_blank" >OFMASUN201301: CIRC - Mobile dedicated devices to fulfilling ability to respond to cyber incidents</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Publication year
2014
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection
Proceedings of International Conference on Frontiers of Communications, Networks and Applications
ISBN
9781785610721
ISSN
—
e-ISSN
—
Number of pages
5
Pages from-to
1-5
Publisher name
IEEE Xplore Digital Library
Place of publication
Kuala Lumpur, Malaysia
Event location
Kuala Lumpur, Malaysia
Event date
Nov 3, 2014
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—

Similar results(10)