DETECT THE FAST-FLUX BOTNETS WITH THE DNS CHARACTERISTIC

摘要：

　　At present,the fast-flux technology is widely used in Botnet to hide Command&Control Server and improve its robustness.In this paper,we analyze and test fast-flux Botnets features using machine learning in depth.Based the concept of information entropy,we select ten classification features of fast-flux Botnet and quantify the information contained in each feature.We adopt various classification algorithms in experiment test depending on selected features,in which we achieved an effective result.Meanwhile,we describe methods to acquire these features in a network.Moreover,we develop Fast-flux Botnet Real-time Detecting System (FBRDS) based on DNS traffic.Furthermore,we test our system in real network,and analyze its availability.

关键词： Botnet detection Fast-flux DNS

作者: Xiangzhan Yu Liang Zhang Zhaoxin Zhang Dan Liu

作者单位: School of Computer Science and Technology,Harbin Institute of Technology,Harbin 150001,China National Computer network Emergency Response technical Team / Coordination Center of China,Beijing 1 IBM China Design Center,Beijing 100020,China

会议类型: 国际会议

会议名称: 2012 2nd IEEE International Conference on Cloud Computing and Intelligence Systems (2012年第2届IEEE云计算与智能系统国际会议(IEEE CCIS2012))

会议地点: 杭州

会议语种:英文

页码: 835-841

在线出版日期: 2012-10-30（万方平台首次上网日期，不代表论文的发表时间）