A Survey on Fast-flux Attacks

Abstract

Fast-flux" refers to rapidly assigning different IP addresses to the same domain name. Although there are some legitimate uses for this technique, recently it has become a favorite tool for cyber criminals to launch collaborative attacks. After it was first observed by Honeynet, it was reported that fast-flux has been used in phishing, malware spreading, spam, and other malicious activities linked to criminal organizations. Combining with peer-to-peer networking, distributed command and control, web-based load balancing, and proxy redirection, fast-flux makes Internet attacks more resistant to discovery and counter-measure. This article aims at giving a comprehensive survey on fast-flux attacks. Some important issues including technical background, classification, characterization, measurement and detection, and mitigation are discussed. Challenges of detecting and mitigating fast-flux attack are also pointed out.

Investigating the Agility Bias in DNS Graph Mining

“…2, an important question is whether there even is a saturation point for the visualized cumulative counts. While the plots allow to question whether the saturation was reached with q = 3000, the answer should still be negative; the counts should not grow without bound [7]. That is, the elaborated sampling bias should not be expected to tend to infinity.…”

Fast Flux Service Network Detection via Data Mining on Passive DNS Traffic

“…A relevant metric for the detection of malicious fast flux is the number of IPs returned in a single A query. In particular, we consider the maximum m al of such value: a malicious fast flux is believed to typically have a m al larger than a legitimate fast flux [22,35].…”

“…Cumulative Number of Public Networks. Since the botnet underlying a malicious fast flux contains infected machines which are typically distributed quite randomly in different networks, the same is expected to be true for the IPs retrieved by the related queries [22,35]. For this reason a malicious fast flux typically has a number of public networks (n net ) larger than a legitimate CDN.…”

“…Change in the Set of Public Networks. While CDNs typically use IPs taken from the same few public networks, malicious fast flux frequently introduce IPs from new networks [22,35]. We measure the change in the set of public networks by means of c net = n net /n c net − 1, where n c net is the network-analogous of n c IP .…”

“…Change in the Answer Length. Another relevant indicator is the change in the number of IPs retrieved in each query [22,35].…”