Detecting Malicious Fast Flux Domains

Abstract

Fast-flux service networks (FFSN) are new emerging phenomenon in the internet. Fast-flux networks use proxy networks of compromised machines to redirect and host scam service to achieve high availability. Such technique helps scam websites to avoid being traced and taken down by security professionals. In this paper, we use alternative decision tree algorithm to identify presence of fast-flux domains by analyzing only one address record (A-record) of DNS lookup, which achieves fast detection.