Autonomous Detection of Botnets Using Passive DNS

729 Words2 Pages
bulb-icon

Recommended: Botnets - Background

1
Background
A botnet is a collection of compromised hosts (bots) under control of a com- mon Command & Control (C&C). The C&C is used by a remote controller to issue commands to the different infected hosts. A botnet may have several purposes, the most common include Denial-of-Servoice (DoS) attacks, identity theft, proxy, spreading of malware and spamming. Traditional ways to disrupt such networks, such as Domain Name System Blacklists (DNSBL’s) or firewalls, rely on the knowledge of the Internet address of the C&C.
Domain Name System (DNS) is of paramount importance in the operation of internet. It is responsible for translating human-friendly hostnames into IP addresses. Botmasters make use of domain names to manage their distributed network of bots. Furthermore, they take advantage of DNS agility (ability to quickly change the IP address associated to a domain name) to hide and frustrate detection of their C&C. Such techniques include DGA [1], Fast-Flux [4].
2
Research Questions
As aforementioned, attackers have been able to avoid the deployed detection/prevention mechanisms by continously update the IP address of their C&C. This makes the disruption of the botnet more difficult. In addition, techniques like Fast-Flux or DGA take advantage of the fact that DNS services do not keep the history of the DNS requests, DNS data only contains the current value of each domain name, making the identification of the botnet C&C even more difficult [5].
Passive DNS [6] comes to help in this case, by storing all DNS answers that goes through a deployed sensor into a database and allowing queries over that data. Moreover, Passive DNS allows one to correlate DNS data over time, being possible to analyze the migration pattern of the botnet, ...

... middle of paper ...

...Berke- ley, CA, USA, 2012. USENIX Association.
[2] M. Bailey, E. Cooke, F. Jahanian, Yunjing Xu, and M. Karir. A survey of botnet technology and defenses. In Conference For Homeland Security,
2009. CATCH ’09. Cybersecurity Applications Technology, pages 299–304,
2009.
[3] Maryam Feily, Alireza Shahrestani, and Sureswaran Ramadass. A survey of botnet and botnet detection. In Proceedings of the 2009 Third International
Conference on Emerging Security Information, Systems and Technologies,
SECURWARE ’09, pages 268–273. IEEE Computer Society, 2009.
[4] D.K. McGrath, A. Kalafut, and M. Gupta. Phishing infrastructure fluxes all the way. Security Privacy, IEEE, 7(5):21–28, 2009.
[5] C. Schiller and J.R. Binkley. Botnets: The Killer Web Applications. Elsevier
Science, 2011.
[6] Florian Weimer. Passive dns replication. In FIRST Conference on Computer
Security Incident, 2005.

Show More
Related

  • The End Of Spam Shame Analysis

    398 Words  | 1 Pages

    In the essay “The End of Spam Shame: On Class, Colonialism, and Canned Meat,” Sylvie Kim, the author, argues that no culture or person should be judged based on what foods they eat. Kim argues this by using her love for spam to explain the cultural difference and judgement she has experienced being an Asian-American consumer of the “pink gelatinous pork” (3). Sylvie explains personal shame and fear of judgement when eating spam to her audience, Asian-American readers of the blog “hyphenmagazine.com.” She elaborates on her disgust for judgement by using the argumentative writing style of repetition. She continually reuses the word love. This writing style is crucial

    Read More

  • Nt1310 Unit 7

    849 Words  | 2 Pages

    What is a problem with DNS? There is DNS spoofing and DNS hijacking both usually done by hackers, and they could direct users to websites containing malware or a third-party search engine or just corrupt DNS data in general.

    Read More

  • Decoy Systems for Computer Crimes: Honeypots

    923 Words  | 2 Pages

    In a world of computer crime, stolen identities, and network sabotage it would seem that hackers are the ones with the advantage with the rest of us playing the defensive. There are a number of tools that we use to fight back, such as: Anti-virus applications, firewalls, and encryption. These are some of the most well-known defensive strategies but there also exist one that actually encourages attacks, and is commonly called a honeypot. If you can remember the allure that Winnie the Pooh had for honey, the principal idea behind a honeypot should not be difficult to understand.

    Read More

  • Wgu Community Statistics Assignment

    1564 Words  | 4 Pages

    Record the data you collect into the following tables. Record the source (website) of your data in the Source Column. Collect the most recent data available (usually within the last 5 years). If you cannot find that data for a few inquiries just enter “NDA” – No Data Available. However, this should be limited to two or

    Read More

  • TOR: Onion Routing

    1221 Words  | 3 Pages

    Onion routing (Syverson) is an anonymous communication technique used to anonymize network traffic. Messages are encrypted recursively and sent to multiple network nodes or onion routers; each router decrypts one layer of the message and passes it on to the next router. This prevents the transport medium to find out who you are; the network does know that onion communication is taking place.

    Read More

  • Case Study: Akamai Technologies

    2116 Words  | 5 Pages

    Akamai provides services to their customers, it delivers the content to user by just browsing through web browser and downloading the contents from the server. “ Akamai does this task simultaneously mirroring contents, sometimes all site content including HTML, CSS and all software downloads and sometime just media objects, audio, graphics, animation, video or hyper texts ”, than Customer makes up an request and domain name is same and the Internet protocol address points to the one of the Akamai server or to some different machine, after the client request the servers from Akamai picked up automatically which depends on the current location of the user or the contents required by the user.

    Read More

  • Spam Engine Research Paper

    460 Words  | 1 Pages

    If you've had an email address for any length of time, you've probably deleted plenty of spam emails trying to sell you a kit that makes your car run off of water. A kit that does this means that a lot of money can be saved since water is far cheaper and more available than gasoline or diesel fuel. If what the spam emails claim is true, why hasn't someone become a billionaire by starting a company around the concept?

    Read More

  • Guide to Spybot Search and Destroy

    1688 Words  | 4 Pages

    Click on the first “download here” button as shown in figure 3. This will take you to a mirror selection page. In other words, a list of available download locations allows users to choose the web site from which they want to download Spybot S&D.

    Read More

  • Malware Case Study

    729 Words  | 2 Pages

    The Target breach which is said to be the second-largest retail cyber-attack in history wasn’t necessarily inventive, nor did it appear destined for success, yet hackers were able to access roughly 40 million customers personal information by installing a malware into Target’s security system.1 In the days leading up to Thanksgiving 2013 the hackers installed malware in Target’s security and payments system which was designed to steal every credit card used in store at over 1,797 U.S. locations. The data breach initially disclosed in December which exposed around 40 million customer’s names, card numbers, card expiration dates, card security codes and debit card pins were recorded for the hackers to see, although the pins were encrypted. After a later review Target disclosed additional information which later was said to be that roughly 70 million more consumers had their names, addresses, phone numbers and email addresses exposed.2

    Read More

  • Distributed Denial of Service Attacks

    627 Words  | 2 Pages

    Within the last decade, the internet has proven to be the most efficient way to complete tasks in today’s society. Every major business in today’s society relies on the internet to conduct business. Though the internet is a useful tool, our reliability on it opens up the door for cyber-attacks that can be detrimental to business as a whole. One example of a cyber-attacks that have recently started becoming more prevalent are DDoS attacks. Recently, DDoS attacks have been a rising issue for businesses owners who run their own servers, such as video game companies and other high profile web servers, including banks and other credit card payment gateways.

    Read More

  • How the Internet Changed Business

    1717 Words  | 4 Pages

    Ten years ago, the Internet as we know it hit screens. It was 1995 when Explorer and Netscape emerged as the leading browsers for Internet users. Of course, a lot has changed since the days when it took several minutes to load one Web page. Today, URLs are as common as phone numbers for most businesses.

    Read More

  • Hackers and the Internet

    1370 Words  | 3 Pages

    Hackers and the Internet Internet Security covers a broad list of topics. I have chosen to cover hackers and their history. I will go through who hackers are and how we define hackers. I will also cover the history of how hackers got started. This was a very interesting topic and may surprise a lot of people who have had misconceptions about what hackers do due to how the are covered by the media.

    Read More

  • A Signature-Based Approach against Polymorphic Internet Worms

    1854 Words  | 4 Pages

    h Babu Battula Ram Bilash(2010UCP233) 1 CONTENTS 1. Introduction 2. Related Work 3. Design 3.1 Failure Connection Design 3.2 Signature discoverion Design 4. Results 5.

    Read More

  • Privacy on the Internet

    2274 Words  | 5 Pages

    Thanks to the HTTP, a web server running some simple software programs can acquire our IP address and then gather information about us from our own computer. This information can be anywhere from what kind of software the computer is running to gaining access to all our email contacts. Sometimes less desirabl...

    Read More

  • Privacy in Cyberspace

    986 Words  | 2 Pages

    Many browsers keep track of where you have been on the Internet by using cookies. A cookie file is a small piece of information that a web server can store. However cookies are not without their problems. On...

    Read More

More about Autonomous Detection of Botnets Using Passive DNS

Open Document