BotMeter: Charting DGA-Botnet Landscapes in Large Networks

Wang, Ting; Hu, Xin; Jang, Jiyong; Ji, Shouling; Stoecklin, Marc Ph.; Taylor, Teryl

doi:10.1109/icdcs.2016.77

Cited by 14 publications

(9 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [15], offline analysis to detect DGA botnets through whitelist filtering and clustering was given. In [16], BotMeter, a tool that charts the DGA-bot population landscapes in large-scale networks was proposed, which relies on a long period of analysis.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Detecting Word-Based Algorithmically Generated Domains Using Semantic Analysis

et al. 2019

View full text Add to dashboard Cite

In highly sophisticated network attacks, command-and-control (C&C) servers always use domain generation algorithms (DGAs) to dynamically produce several candidate domains instead of static hard-coded lists of IP addresses or domain names. Distinguishing the domains generated by DGAs from the legitimate ones is critical for finding out the existence of malware or further locating the hidden attackers. The word-based DGAs disclosed in recent network attack events have shown significantly stronger stealthiness when compared with traditional character-based DGAs. In word-based DGAs, two or more words are randomly chosen from one or more specific dictionaries to form a dynamic domain, these regularly generated domains aim to mimic the characteristics of a legitimate domain. Existing DGA detection schemes, including the state-of-the-art one based on deep learning, still cannot find out these domains accurately while maintaining an acceptable false alarm rate. In this study, we exploit the inter-word and inter-domain correlations using semantic analysis approaches, word embedding and the part-of-speech are taken into consideration. Next, we propose a detection framework for word-based DGAs by incorporating the frequency distribution of the words and that of part-of-speech into the design of the feature set. Using an ensemble classifier constructed from Naive Bayes, Extra-Trees, and Logistic Regression, we benchmark the proposed scheme with malicious and legitimate domain samples extracted from public datasets. The experimental results show that the proposed scheme can achieve significantly higher detection accuracy for word-based DGAs when compared with three state-of-the-art DGA detection schemes.

show abstract

Section: Related Workmentioning

confidence: 99%

“…In actual fact, the methods in [12][13][14][15][16] are all limited by the status of the network environment and data integrity. In real networks, especially in large-scale networks, these traffic features are very difficult to collect.…”

Section: Related Workmentioning

confidence: 99%

Detecting Word-Based Algorithmically Generated Domains Using Semantic Analysis

et al. 2019

View full text Add to dashboard Cite

show abstract

“…The technique is design to identify DNS anomaly machine in an enterprise level so as to detect bot infected machine using DNS fingerprinting [18]. In 2016, [19] introduced a Bot-Meter: Charting DGA-Botnet Landscapes in Large Networks that scan through group activities within a network for possible bot. However, before the emergence of some sophisticated techniques as discussed above, several techniques as itemized in Table 1 have been used to curb botnet.…”

Section: The Botnet and Recent Curbing Mechanismmentioning

confidence: 99%

The Historical Perspective of Botnet Tools

Osagie

Enagbonma²,

Inyang³

2019

CJAST

View full text Add to dashboard Cite

Bot as it is popularly called is an inherent attributes of botnet tool. Botnet is a group of malicious tools acting as an entity. Furthermore, history has it that the aim of what gave rise to botnet was the idea to simplify the method of message exchange within networking platform. However, this has led to several botnet tools ravaging the server environments in recent times. The working principle of these botnet tools is to get client systems that are vulnerable and thereafter, steal valuable credentials. This work is part of a comprehensive research work into botnet detection mechanism but, on this paper it primarily look at how botnet as threat tool began, the trend since inception and as well as few approaches that have been used to curb it.

show abstract

“…Zhang et al presented Botdigger , which can detect an individual bot by gathering and analyzing the data from a single network. Wang et al devised BotMeter , which assesses the populations of DGA‐based botnets over large networks by analyzing the DNS lookups at upper‐level DNS servers.…”

Section: Related Workmentioning

confidence: 99%

Thriving on chaos: Proactive detection of command and control domains in internet of things‐scale botnets using DRIFT

Spaulding

Park

Kim

et al. 2018

Trans Emerging Tel Tech

View full text Add to dashboard Cite

In this paper, we introduce DRIFT, a system for detecting command and control (C2) domain names in Internet of Things–scale botnets. Using an intrinsic feature of malicious domain name queries prior to their registration (perhaps due to clock drift), we devise a difference‐based lightweight feature for malicious C2 domain name detection. Using NXDomain query and response of a popular malware, we establish the effectiveness of our detector with 99% accuracy and as early as more than 48 hours before they are registered. Our technique serves as a tool of detection where other techniques relying on entropy or domain generating algorithms reversing are impractical.

show abstract

BotMeter: Charting DGA-Botnet Landscapes in Large Networks

Cited by 14 publications

References 9 publications

Detecting Word-Based Algorithmically Generated Domains Using Semantic Analysis

Detecting Word-Based Algorithmically Generated Domains Using Semantic Analysis

The Historical Perspective of Botnet Tools

Thriving on chaos: Proactive detection of command and control domains in internet of things‐scale botnets using DRIFT

Contact Info

Product

Resources

About