DNS query failure and algorithmically generated domain-flux detection

Abstract

Botnets are now recognized as one of the most serious security threats. Recent botnets such as Conficker, Murofet and BankPatch have used domain flux technique to connect to their command and control (C&C) servers, where each Bot queries for existence of a series of domain names used as rendezvous points with their controllers while the owner has to register only one such domain name. The large number of potential rendezvous points makes it difficult for law enforcement to effectively shut down botnets. In this paper we present our methodology for detecting algorithmically generated domain flux. Our detection method is based on DNS query failures resulting from domain flux technique. We process the network traffic, particularly DNS traffic. We analyze all DNS query failures and propose a threshold for DNS query failures from the same IP address. We applied our methodology on packet capture (pcap) file which contains real and long-lived malware traffic and we proved that our methodology can successfully detect domain flux technique and identify the infected host. We also applied our methodology on campus live traffic and showed that it can automatically detect domain flux technique and identify the infected host in the real time.

Cyber Security Challenges in Smart Grids

“…False data assaults require the insertion of false software into meters. A linear factor of the Jacobian power system matrix can be used to manipulate measurements across the network for FDI attacks [37], [42]. The current state approximation methods do not notice this shift in the calculation.…”

Disguised executable files in spear-phishing emails

“…First, eight detection modules are employed to detect the individual APT steps. ese modules are Tor connection detection [11], malicious SSL certicate detection [12], malicious le hash detection [13], malicious domain name detection [14], domain ux detection [15], malicious IP address detection [16], scan detection and disguised exe le detection. Second, a correlation methodology including clustering algorithms is utilised to correlate the steps related to one APT campaign.…”

Defending against the advanced persistent threat: Detection of disguised executable files

“…For that purpose, eight detection modules are presented, which are disguised exe file detection, malicious file hash detection [15], malicious domain name detection [16], malicious IP address detection [17], malicious SSL certificate detection [18], domain flux detection [19], scan detection, and Tor connection detection [20]. The second phase includes a correlation framework to link the outputs of the detection modules.…”