Fast-flux hunter: a system for filtering online fast-flux botnet

Almomani, Ammar

doi:10.1007/s00521-016-2531-1

Cited by 32 publications

(20 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…e literature [72] proposed a real-time online Fast-Flux botnet filtering system, aiming to improve the detection of unknown "zero-day" online fast-flux botnets. Fast-Flux botnet domain was distinguished from the legal domain in an online mode based on new rules, characteristics, or classes.…”

Section: Fnnmentioning

confidence: 99%

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

Xing

Hui

Zhao

et al. 2021

Mathematical Problems in Engineering

View full text Add to dashboard Cite

With the continuous evolution of the Internet, as well as the development of the Internet of Things, smart terminals, cloud platforms, and social platforms, botnets showing the characteristics of platform diversification, communication concealment, and control intelligence. This survey analyzes and compares the most important efforts in the botnet detection area in recent years. It studies the mechanism characteristics of botnet architecture, life cycle, and command and control channel and provides a classification of botnet detection techniques. It focuses on the application of advanced technologies such as deep learning, complex network, swarm intelligence, moving target defense (MTD), and software-defined network (SDN) for botnet detection. From the four dimensions of service, intelligence, collaboration, and assistant, a common bot detection evaluation system (CBDES) is proposed, which defines a new global capability measurement standard. Combing with expert scores and objective weights, this survey proposes quantitative evaluation and gives a visual representation for typical detection methods. Finally, the challenges and future trends in the field of botnet detection are summarized.

show abstract

Section: Fnnmentioning

confidence: 99%

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

Xing

Hui

Zhao

et al. 2021

Mathematical Problems in Engineering

View full text Add to dashboard Cite

show abstract

“…Mathematical and data mining techniques were applied on a set of features that are extracted from the monitored traffic in order to achieve near real-time fast flux detection. A system called Fast-flux hunter was proposed in [12]. The system combines supervised and unsupervised online knowledge learning based system for fast flux detection based on features extracted from passive DNS traffic.…”

Section: Related Workmentioning

confidence: 99%

PASSVM: A Highly Accurate Online Fast Flux Detection System

Al-Duwairi,

Jarrah,

Shatnawi

2020

Preprint

View full text Add to dashboard Cite

Fast Flux service networks (FFSNs) are used by adversaries to achieve a high resilient technique for their malicious servers while keeping them hidden from direct access. In this technique, a large number of botnet machines, that are known as flux agents, work as proxies to relay the traffic between end users and a malicious mothership server which is controlled by an adversary. Various mechanisms have been proposed for detecting FFSNs. Such mechanisms depend on collecting a large amount of DNS traffic traces and require a considerable amount of time to identify fast flux domains. In this paper, we propose an efficient AI-based online fast flux detection system that performs highly accurate and extremely fast detection of fast flux domains. The proposed system, called PASSVM, is based on features that are associated with DNS response messages of a given domain name. The approach relies on features that are stored in two local databases, in addition to features that are extracted from the response DNS messages itself. The information in the databases are obtained from Censys search engine and IP Geolocation service. PASSVM is evaluated using three types of artificial neural networks which are: Multilayer Perceptron (MLP), Radial Basis Function Network (RBF), and Support Vector Machines (SVM). Results show that SVM with RBF kernel outperformed the other two methods with an accuracy of 99.557% and a detection time of less than 18 ms.

show abstract

“…Domain-fluxing uses a DGA to generate many domain names and then attempts to communicate with a small section of the generated domains [37]. Bilge et al [8] explains that the use of domain names gives the attackers the flexibility and redundancy of migrating their servers with ease.…”

Section: Domain-flux and Ip-fluxmentioning

confidence: 99%

Detection of Algorithmically Generated Malicious Domain Using Frequency Analysis

Agyepong¹,

Buchanan²,

Jones³

2018

IJCSIT

View full text Add to dashboard Cite

Malicious use and exploitation of Dynamic Domain Name Services (DDNS) capabilities poses a serious threat to the information security of organisations and businesses. In recent times, many malware writers have relied on DDNS to maintain their Command and Control (C&C) network infrastructure to ensure a persistence presence on a compromised host. Amongst the various DDNS techniques, Domain Generation Algorithm (DGA) is often perceived as the most elusive and difficult to detect using traditional methods. This paper presents an approach for detecting DGA using frequency analysis of the character distribution and the weighted scores of the domain names. The approach's feasibility is demonstrated using a range of legitimate domains and a number of malicious algorithmically-generated domain names. When a weighted score of < 45 is applied to the Alexa one million list of domain names, only 15% of the domain names were treated as non-human generated.

show abstract

Fast-flux hunter: a system for filtering online fast-flux botnet

Cited by 32 publications

References 13 publications

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

PASSVM: A Highly Accurate Online Fast Flux Detection System

Detection of Algorithmically Generated Malicious Domain Using Frequency Analysis

Contact Info

Product

Resources

About