Geo-spatial autocorrelation as a metric for the detection of fast-flux botnet domains

Stalmans, Etienne; Hunter, Samuel O; Irwin, Barry V W

Title: Geo-spatial autocorrelation as a metric for the detection of fast-flux botnet domains
Creator: Stalmans, Etienne
Creator: Hunter, Samuel O
Creator: Irwin, Barry V W
Subject: To be catalogued
Date Issued: 2012
Date: 2012
Type: text
Type: article
Identifier: http://hdl.handle.net/10962/429799
Identifier: vital:72640
Identifier: 10.1109/ISSA.2012.6320433
Description: Botnets consist of thousands of hosts infected with malware. Botnet owners communicate with these hosts using Command and Control (C2) servers. These C2 servers are usually infected hosts which the botnet owners do not have physical access to. For this reason botnets can be shut down by taking over or blocking the C2 servers. Botnet owners have employed numerous shutdown avoidance techniques. One of these techniques, DNS Fast-Flux, relies on rapidly changing address records. The addresses returned by the Fast-Flux DNS servers consist of geographically widely distributed hosts. The distributed nature of Fast-Flux botnets differs from legitimate domains, which tend to have geographically clustered server locations. This paper examines the use of spatial autocorrelation techniques based on the geographic distribution of domain servers to detect Fast-Flux domains. Moran's I and Geary's C are used to produce classifiers using multiple geographic co-ordinate systems to produce efficient and accurate results. It is shown how Fast-Flux domains can be detected reliably while only a small percentage of false positives are produced.
Format: 7 pages
Format: pdf
Language: English
Relation: Information Security for South Africa
Relation: Stalmans, E., Hunter, S.O. and Irwin, B., 2012, August. Geo-spatial autocorrelation as a metric for the detection of fast-flux botnet domains. In 2012 Information Security for South Africa (pp. 1-7). IEEE
Relation: Information Security for South Africa volume 2012 number 1 1 7 2012 2330-9881
Rights: Publisher
Rights: Use of this resource is governed by the terms and conditions of the IEEE Xplore Terms of Use Statement (https://ieeexplore.ieee.org/Xplorehelp/overview-of-ieee-xplore/terms-of-use)

Hits: 101
Visitors: 106
Downloads: 7

Collections

Irwin, Barry V W (Prof)

RU Department of Computer Science

SDG 09. Industry, Innovation and Infrastructure

		Thumbnail	File	Description	Size	Format
View Details Download			SOURCE1	Geo-spatial autocorrelation as a metric for the detection of fast-flux botnet domains.pdf	653 KB	Adobe Acrobat PDF	View Details Download