摘要
Fast-flux is a Domain Name System(DNS)technique used by botnets to organise compromised hosts into a high-availability,loadbalancing network that is similar to Content Delivery Networks(CDNs).Fast-Flux Service Networks(FFSNs)are usually used as proxies of phishing websites and malwares,and hide upstream servers that host actual content.In this paper,by analysing recursive DNS traffic,we develop a fast-flux domain detection method which combines both real-time detection and long-term monitoring.Experimental results demonstrate that our solution can achieve significantly higher detection accuracy values than previous flux-score based algorithms,and is light-weight in terms of resource consumption.We evaluate the performance of the proposed fast-flux detection and tracking solution during a 180-day period of deployment on our university’s DNS servers.Based on the tracking results,we successfully identify the changes in the distribution of FFSN and their roles in recent Internet attacks.
Fast-flux is a Domain Name System （DNS） technique used by botnets to organise compromised hosts into a high-availability, load- balancing network that is similar to Content Delivery Networks （CDNs）. Fast-Flux Service Networks （FFSNs） are usually used as proxies of phishing websites and malwares, and hide upstream servers that host actual content. In this paper, by analysing recursive DNS traffic, we develop a fast-flux domain detection met- hod which combines both real-time detection and long-term monitoring. Experimental res- ults demonstrate that our solution can achieve significantly higher detection accuracy values than previous flux-score based algorithms, and is light-weight in terms of resource consump- tion. We evaluate the performance of the pro- posed fast-flux detection and tracking solution during a 180-day period of deployment on our university＇s DNS servers. Based on the track- ing results, we successfully identify the chan- ges in the distribution of FFSN and their roles in recent Internet attacks.
基金
supported by the National Basic Research Program of China(973 Program)under Grant No.2013CB329603
Huawei Innovation Research Program
the Opening Project of Key Laboratory of Information Network Security of Ministry of Public Security under Grant No.C11608
the National Natural Science Foundation of China under Grant No.61271220
