Identifying Fast-Flux Botnet With AGD Names at the Upper DNS Hierarchy

Abstract

Modern botnets rely on a new DNS technique called fast-flux to organize compromised hosts into fast-flux service networks (FFSNs), which helps bot herds to hide their upstream servers. Given the prevalence of this mechanism, various approaches have been proposed to detect them by analyzing DNS traffic. However, these detection mechanisms either have low detection accuracy or long detection latency. Moreover, they cannot capture the behavioral regularity and other novel traits of the evolving behavior of each botnet which is being tracked. This paper proposes a new FFSNs detection scheme to solve the above-mentioned limitations. The proposed approach can recognize groups of domains generated by a domain generation algorithms or its variants that are representative of different botnets. In addition to that, it can also identify whether the algorithmically generated domain names in a cluster are using fast-flux technology or not by applying a double-stages detection mechanism. The proposed work is implemented in a real network (China Education and Research Network), and the DNS traffic is collected from backbone routers. Experimental results demonstrate that our algorithm has significantly increased the detection accuracy compared with similar works and reduced the computational complexity.