DBod: Clustering and detecting DGA-based botnets using DNS traffic analysis

详细信息    查看全文

• 作者：Tzy-Shiah Wang ^{tcwang@nsda.ee.ncku.edu.tw" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Hui-Tang Lin ; ^{htlin@mail.ncku.edu.tw" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Wei-Tsung Cheng ^{wtcheng@nsda.ee.ncku.edu.tw" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Chang-Yu Chen ^{markisgood@nsda.ee.ncku.edu.tw" class="auth_mail" title="E-mail the corresponding author}Author Vitae
• 关键词：Domain generation algorithm ; Botnet detection mechanism ; Name error response ; Traffic analysis ; Network security
• 刊名：Computers & Security
• 出版年：2017
• 出版时间：January 2017
• 年：2017
• 卷：64
• 期：Complete
• 页码：1-15
• 全文大小：2074 K

文摘

Botnets are one of the leading threats to network security nowadays and are used to conduct a wide variety of malicious activities, including information theft, phishing, spam mail distribution, and Distributed Denial of Service (DDoS) attacks. Among the various forms of botnet, DGA-based botnets, which utilize a Domain Generation Algorithm (DGA) to avoid detection, are one of the most disruptive and difficult to detect. In such botnets, the DGA is used to generate a huge list of candidate Command and Control (C&C) server domains, and the bot then attempts to connect to an active C&C server by querying each DNS server in turn. DGA-based botnets are highly elusive and difficult to detect using traditional defensive mechanisms and therefore have a high survivability. Accordingly, this study proposes a DGA-based botnet detection scheme designated as DBod based on an analysis of the query behavior of the DNS traffic. The proposed scheme exploits the fact that hosts compromised by the same DGA-based malware query the same sets of domains in the domain list and most of these queries fail since only a very limited number of the domains are actually associated with an active C&C. The feasibility of the proposed method is evaluated using the DNS data collected from an education network environment over a period of 26 months. The results show that DBod provides an accurate and effective means of detecting both existing and new DGA-based botnet patterns in real-world networks.