PsyBoG: A scalable botnet detection method for large-scale DNS traffic

Detection of Algorithmically Generated Malicious Domain

“…This work does not seek to compete with the existing tools for detecting DGA but rather it seeks to complement existing works [1], [2], [3], [7], [18], [27], [44]. This paper expands upon previous work related to the detection of algorithmically-generated domain names [15], and seeks to answer the following research question:…”

“…Whilst DDNS provides a useful feature for organisations that need to maintain consistent services, because they rely on a dynamic IP range allocated by their Internet Service Provider (ISP) [18]. Arntz [5] explains that, cyber-criminals exploit this feature to increase the survivability of their C&C server.…”

Fast-Flux Botnet Detection Based on Traffic Response and Search Engines Credit Worthiness

“…This set of data was manually classified to provide D CDN ' and D BOT ' sets. [20,21,27] No No No Medium Large F2 Place of domain registration (country) [20] Yes No Yes Small Small F3 Number of subdomains in the domain [26] Yes No Yes Medium Large F4 The domain name according to dictionary [26,30,32] Yes No Can Large Small F5 The similarity of certain elements of the domain name with a valid domain name [26,30,33] Yes No Yes Medium Large F6 Numbers in domain names [27] Yes No Yes Small Small F7 The length of the longest word in the domain name [27] Yes No Yes Small Small F8 Number and duration of the connection [26] No No Yes Large Large F9 Similar daily behavior of the domain [27,32] No No Yes Large Large F10 Recurring cycles of query to the authoritative server [28] No The summary set of data used for experimental setup is given by:…”

“…A tool called PsyBoG is developed for detecting malicious behaviour within large volumes of DNS traffic [33]. PsyBoG leverages a signal processing technique, power spectral density (PSD) analysis, to discover the major frequencies resulting from the periodic DNS queries of Botnets.…”

Botnet Detection Technology Based on DNS

“…Provided with the general trend of this mechanism, recent works have focused on the analysis of DNS traffic to identify botnets relying on their DGAs. Various technologies have since been designed to detect DGA domains in DNS traffic, containing analyzing algorithmic models of domains, reverse-engineering malware instances [30,31], grouped into non-existent domains in DNS lookups [32,33], behavioral models [34,35], Social Network Analysis [36], power spectral density (PSD) analysis [37], and directly capturing C and C traffic [38,39]. However, influencing detected DGA domains to create a practical fix to botnet threats in large-scale networks is currently restricted.…”