Detecting Botnets Using Command and Control Traffic

AsSadhan, Basil; Moura, J.M.F.; Lapsley, David; Jones, Christine E; Strayer, W.T.

doi:10.1109/nca.2009.56

Cited by 51 publications

(24 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Traditionally, botnet detection and mitigation systems like BotSniffer [17] have focused on zombies that contact Internet Relay Chat(IRC) C&C servers or utilize IRC-style communication [9]. Unfortunately, botnets have grown in sophistication to use Peer-to-Peer (P2P) and unstructured communication [10,19].…”

Section: Related Workmentioning

confidence: 99%

NetGator: Malware Detection Using Program Interactive Challenges

Schulte

Andrianakis

Sun

et al. 2013

Detection of Intrusions and Malware, and Vulnerability Assessment

View full text Add to dashboard Cite

Abstract. Internet-borne threats have evolved from easy to detect denial of service attacks to zero-day exploits used for targeted exfiltration of data. Current intrusion detection systems cannot always keep-up with zero-day attacks and it is often the case that valuable data have already been communicated to an external party over an encrypted or plain text connection before the intrusion is detected. In this paper, we present a scalable approach called Network Interrogator (NetGator) to detect network-based malware that attempts to exfiltrate data over open ports and protocols. NetGator operates as a transparent proxy using protocol analysis to first identify the declared client application using known network flow signatures.Then we craft packets that "challenge" the application by exercising functionality present in legitimate applications but too complex or intricate to be present in malware. When the application is unable to correctly solve and respond to the challenge, NetGator flags the flow as potential malware. Our approach is seamless and requires no interaction from the user and no changes on the commodity application software. NetGator introduces a minimal traffic latency (0.35 seconds on average) to normal network communication while it can expose a wide-range of existing malware threats.

show abstract

Section: Related Workmentioning

confidence: 99%

NetGator: Malware Detection Using Program Interactive Challenges

Schulte

Andrianakis

Sun

et al. 2013

Detection of Intrusions and Malware, and Vulnerability Assessment

View full text Add to dashboard Cite

show abstract

“…The primary purpose of botnets is for the controlling criminal, group of criminals or organized crime syndicate to use hijacked computers for fraudulent online activity. Experts believe that approximately 16-25% of the computers connected to the Internet are members of botnets [3], [4].…”

Section: Introductionmentioning

confidence: 99%

DNS traffic analysis for malicious domains detection

Ghafir

Přenosil

2015

2015 2nd International Conference on Signal Processing and Integrated Networks (SPIN)

View full text Add to dashboard Cite

The web has become the medium of choice for people to search for information, conduct business, and enjoy entertainment. At the same time, the web has also become the primary platform used by miscreants to attack users. For example, drive-by-download attacks, which could be through malicious domains, are a popular choice among bot herders to grow their botnets. In this paper we present our methodology for detecting any connection to malicious domain. Our detection method is based on a blacklist of malicious domains. We process the network traffic, particularly DNS traffic. We analyze all DNS requests and match the query with the blacklist. The blacklist of malicious domains is updated automatically and the detection is in the real time. We applied our methodology on a packet capture (pcap) file which contains traffic to malicious domains and we proved that our methodology can successfully detect the connections to malicious domains. We also applied our methodology on campus live traffic and showed that it can detect malicious domain connections in the real time.

show abstract

“…Experts believe that approximately 16-25% of the computers connected to the Internet are members of botnets [3] and [4]. Some reports indicate that approximately 80% of all email traffic is spam and that most of these messages are sent via botnets, such as the so called Grum, Cutwail and Rustock botnets [6].…”

Section: Introductionmentioning

confidence: 99%

DNS query failure and algorithmically generated domain-flux detection

Ghafir

Přenosil

2014

International Conference on Frontiers of Communications, Networks and Applications (ICFCNA 2014 - Malaysia)

View full text Add to dashboard Cite

Botnets are now recognized as one of the most serious security threats. Recent botnets such as Conficker, Murofet and BankPatch have used domain flux technique to connect to their command and control (C&C) servers, where each Bot queries for existence of a series of domain names used as rendezvous points with their controllers while the owner has to register only one such domain name. The large number of potential rendezvous points makes it difficult for law enforcement to effectively shut down botnets. In this paper we present our methodology for detecting algorithmically generated domain flux. Our detection method is based on DNS query failures resulting from domain flux technique. We process the network traffic, particularly DNS traffic. We analyze all DNS query failures and propose a threshold for DNS query failures from the same IP address. We applied our methodology on packet capture (pcap) file which contains real and long-lived malware traffic and we proved that our methodology can successfully detect domain flux technique and identify the infected host. We also applied our methodology on campus live traffic and showed that it can automatically detect domain flux technique and identify the infected host in the real time.

show abstract

Detecting Botnets Using Command and Control Traffic

Cited by 51 publications

References 4 publications

NetGator: Malware Detection Using Program Interactive Challenges

NetGator: Malware Detection Using Program Interactive Challenges

DNS traffic analysis for malicious domains detection

DNS query failure and algorithmically generated domain-flux detection

Contact Info

Product

Resources

About