• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Security and Communications Networks >Detecting domain-flux botnet based on DNS traffic features in managed network
【24h】

Detecting domain-flux botnet based on DNS traffic features in managed network

机译：根据托管网络中DNS流量功能检测域通量僵尸网络

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Modern botnets such as Zeus and Conficker commonly utilize a technique called domain fluxing or a domain generation algorithm to generate a large number of pseudo-random domain names (PDNs) dynamically for botnet operators to control their bots. These botnets are becoming one of the most serious threats to Internet security on a global scale. How to prevent their destructive action is one of the most pressing issues of today. In this paper, we focus on detecting domain-flux botnets within the monitored network based on Domain Name System (DNS) traffic features. This method passively captures all DNS traffic from the gateway of a monitored network and then extracts key features to identify PDN. Based on examining and analyzing a large number of legitimate domains as well as PDN generated by botnets, we have discovered that there is a discernible bias in the rules for constructing domain names. Therefore, we introduce a methodology that analyzes DNS traffic to extract the length and the expected value, which can distinguish between a domain name generated by humans or bots. In order to evaluate the effectiveness of the proposed approach, various machine learning algorithms are applied to train predictive models for our detection system. This proposed scheme is implemented and tested in a real local area network. The experimental results show that our proposed method achieves the highest detective efficiency for decision tree algorithms (J48) with an average overall accuracy of up to 92.3% and a false positive rate of 4.8%. Copyright (c) 2016 John Wiley & Sons, Ltd.
机译：诸如Zeus和Conficker之类的现代僵尸网络通常利用一种称为域通量或域生成算法的技术来动态生成大量的伪随机域名（PDN），以使僵尸网络运营商能够控制其僵尸网络。这些僵尸网络正在成为全球范围内对Internet安全的最严重威胁之一。如何防止其破坏性行动是当今最紧迫的问题之一。在本文中，我们专注于根据域名系统（DNS）流量功能检测受监控网络中的域名通量僵尸网络。此方法被动地从受监视网络的网关捕获所有DNS通信，然后提取关键特征以标识PDN。通过检查和分析大量合法域名以及僵尸网络生成的PDN，我们发现在构造域名的规则中存在明显的偏差。因此，我们引入了一种方法，该方法可以分析DNS流量以提取长度和期望值，从而可以区分人类或漫游器生成的域名。为了评估所提出方法的有效性，各种机器学习算法被应用于为我们的检测系统训练预测模型。所提出的方案是在真实的局域网中实现和测试的。实验结果表明，本文提出的方法对决策树算法（J48）的检测效率最高，平均总体准确率高达92.3％，假阳性率为4.8％。版权所有（c）2016 John Wiley＆Sons，Ltd.

著录项

  • 来源
    《Security and Communications Networks》 |2016年第14期|2338-2347|共10页
  • 作者

    Dinh-Tu Truong; Cheng Guang;

  • 作者单位

    Southeast Univ, Sch Comp Sci & Engn, Nanjing 210096, Jiangsu, Peoples R China|Southeast Univ, Minist Educ, Key Lab Comp Network & Informat Integrat, Nanjing 210096, Jiangsu, Peoples R China|Tuyhoa Ind Coll, Dept Informat Technol, Phuyen 620900, Vietnam;

    Southeast Univ, Sch Comp Sci & Engn, Nanjing 210096, Jiangsu, Peoples R China|Southeast Univ, Minist Educ, Key Lab Comp Network & Informat Integrat, Nanjing 210096, Jiangsu, Peoples R China;

  • 收录信息
  • 原文格式 PDF
  • 正文语种 eng
  • 中图分类
  • 关键词

    network security; botnet; domain fluxing; DNS traffic;

    机译：网络安全;僵尸网络;域通量;DNS流量;

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号