A Survey of Fast Flux Botnet Detection With Fast Flux Cloud Computing

Abstract

A botnet refers to a set of compromised machines controlled distantly by an attacker. Botnets are considered the basis of numerous security threats around the world. Command and control (C&C) servers are the backbone of botnet communications, in which bots send a report to the botmaster, and the latter sends attack orders to those bots. Botnets are also categorized according to their C&C protocols, such as internet relay chat (IRC) and peer-to-peer (P2P) botnets. A domain name system (DNS) method known as fast-flux is used by bot herders to cover malicious botnet activities and increase the lifetime of malicious servers by quickly changing the IP addresses of the domain names over time. Several methods have been suggested to detect fast-flux domains. However, these methods achieve low detection accuracy, especially for zero-day domains. They also entail a significantly long detection time and consume high memory storage. In this survey, we present an overview of the various techniques used to detect fast-flux domains according to solution scopes, namely, host-based, router-based, DNS-based, and cloud computing techniques. This survey provides an understanding of the problem, its current solution space, and the future research directions expected.

Distributed Denial-of-Service (DDoS) Attacks and Defense Mechanisms in Various Web-Enabled Computing Platforms

“…It utilizes the steganographic techniques, which 'embed' the botnet code into a picture or a PDF document attached to an email that often mimics a colleague or friend. A new and unique form of botnets coming into play today are the Fast Flux Networks (FFNs) which promise high flexibility and availability (Al-Nawasrah et al, 2020). It keeps on changing the IP addresses of the domain names in order to avoid detection and prospective shutdown by intrusion detection systems.…”

A statistical approach to secure health care services from DDoS attacks during COVID-19 pandemic

“…However, the proposed approach is based on individual filtering. In order to detect the spoofed packets, researchers proposed many methods [ 36 ], but the main limitation of these methods is that they cannot detect a new type of attack, and their detection time and memory usage is high.…”

Botnet detection used fast-flux technique, based on adaptive dynamic evolving spiking neural network algorithm

“…Botnets for example are used for launching attacks of distributed denial-of-service (DDoS). They are used for identifying thefts, sending spam and phishing emails (Ammar et al, 2018;Almomani et al, 2015Almomani et al, , 2013Almomani, 2018;Alieyan et al, 2018;Alauthaman et al, 2018;Alauthman et al, 2020;Alieyan et al, 2019;Al-Kasassbeh et al, 2020;Alauthman and Albesani, 2019;Al-Nawasrah et al, 2020). Fast flux networks (FFNs) serve as a kind of botnet.…”