Fast-flux service network detection based on spatial snapshot mechanism for delay-free detection

Abstract

Capturing Fast-Flux Service Networks (FFSNs) by temporal variances is an intuitive way for seeking to identify rapid changes of DNS records. Unfortunately, the features regard to temporal variances would lead to the delay detection (more than one hour) of FFSN which could cause more damages, such as Botnet propagation and malware delivery. In this study, we proposed a delay-free detection system, Spatial Snapshot Fast-flux Detection system (SSFD), for identifying FFSN in real time and alleviating these potential damages. SSFD is capable to capture the geographical pattern of hosts as well as mapping IP addresses in a DNS response into geographic coordinate system for revealing FFSNs at the moment. The SSFD benefits from two novel spatial measures proposed in this study-spatial distribution estimation and spatial service relationship evaluation. These two measures consider the degree of uniform geographic distribution of infected hosts among FFSN composed of Bots, Content Distribution Network and general benign services. After that, Bayesian network classifier is applied to identify the FFSNs with the joint probability consideration against evading our proposed detection technique easily for attackers. Our experiment results indicate that the proposed SSFD system is more effective and efficient (within less than 0.5 second) with lower False Positive rate than flux-score based detection through one public dataset and two collected datasets.

Detection of Fast-Flux Domains

“…Researches [6], [8], [10]- [12] inspected fast-flux domain based on the information collected and stored in a database. Referencing database required a certain amount of storage for processing and the information should be up-to-date or the detection rate might be affected.…”

“…FluxOR [4] was to identify malicious fast-flux domains by three categories (domain name, the availability of network, and the heterogeneity of agents) and nine features of DNS/IP information. Huang [6] applied IP addresses to find the actual geographical coordinate distribution to determine the malicious fast-flux Chia-Mei Chen, Sheng-Tzong Cheng, and Ju-Hsien Chou Detection of Fast-Flux Domains domain. Hsu [7] considered the stability of transmission latency time as C&C flux agents may have variant network bandwidth and dynamic response time.…”

Good guys vs. Bot Guise: Mimicry attacks against fast-flux detection systems

“…RELATED WORK Recently, a number of techniques have been proposed to effectively detect FF domains [2], [8], [3], [9], [4]. They started with collecting DNS queries for a large number of suspicious domains through either active or passive monitoring, over time periods ranging from 1 or 2 TTLs to weeks.…”

“…They started with collecting DNS queries for a large number of suspicious domains through either active or passive monitoring, over time periods ranging from 1 or 2 TTLs to weeks. From these traces, they extracted similar sets of DNS features that can be used to characterize FF domains, for instance, the number of unique IPs, ASes, TLDs and spatial distribution [4] of IPs (similar to the number of ASes, the spatial distribution feature captures the dispersive nature of FF botnet IPs). Classification algorithms, such as support vector machines (SVM) [2], decision trees [8] and Bayesian network [4], were applied to the extracted features, determining if each domain is a FF domain.…”

“…From these traces, they extracted similar sets of DNS features that can be used to characterize FF domains, for instance, the number of unique IPs, ASes, TLDs and spatial distribution [4] of IPs (similar to the number of ASes, the spatial distribution feature captures the dispersive nature of FF botnet IPs). Classification algorithms, such as support vector machines (SVM) [2], decision trees [8] and Bayesian network [4], were applied to the extracted features, determining if each domain is a FF domain. In this paper, we have demonstrated that, with the abundant resources currently available to botmasters, most of these features can be effectively subverted by the proposed mimicry attacks.…”