Detect fast-flux domains through response time differences

NCUIR > College of Electrical Engineering & Computer Science > Department of Computer Science and information Engineering > journal & Dissertation > Item 987654321/106594

Please use this identifier to cite or link to this item: https://ir.lib.ncu.edu.tw/handle/987654321/106594

Title:	Detect fast-flux domains through response time differences
Authors:	許富皓;Hsu, Fu-Hau;Wang, Chuan-Sheng;Hsu, Chi-Hsien;Tso, Chang-Kuo;Chen, Li-Han;Lin, Song-Hui
Contributors:	資訊電機學院資訊工程學系
Keywords:	Equations;Internet appliances;IP networks;Mathematical model;Measurement;Servers;Time factors;Training
Date:	2014-10-01
Issue Date:	2026-04-23 13:30:32 (UTC+8)
Publisher:	Institute of Electrical and Electronics Engineers Inc.;New York: IEEE
Abstract:	摘要： A fast-flux service network (FFSN) uses dynamic DNS to map a dynamic domain, called fast-flux domain (FF domain), to various IP addresses and uses flux bots to redirect network traffic. Due to its powerful capability to conceal the hosts hidden behind the flux bots, FFSNs are widely adopted by attackers to cover various scams. Although diverse promising solutions have been proposed to detect FF domains, they face the same problem-different countermeasures could be used to bypass their detection. Hence, it becomes a critical issue to develop a new detection solution. According to our survey, unlike normal network services that use dynamic DNS to balance the workloads of their hosts, FFSNs utilize dynamic DNS to hide important bots. As a result, the response time of subsequent requests to an FF domain becomes more fluctuating. Based on the response time differences, this paper develops a new metric, Fast-Flux Score (FF-Score), to detect FF domains. Our system, called fast-flux domain detector (FFDD), is used on a computer that could be an end host or an IDS. A user with a set of unknown URLs, which may be obtained from spam or social networks, can simply determine whether they are benign domains or fast-flux ones using FFDD. Experimental results show that FFDD can accurately detect FF domains with only a 0.3% false positive rate and a 2% false negative rate. It takes less than 20 min for FFDD to determine whether a domain is an FF domain. In addition, FFDD is a lightweight stand-alone system; hence, it does not require special support from an ISP or any other network service. 其他題名： J-SAC 出版者： New York: IEEE 出版日期： 2014-10 出處： IEEE journal on selected areas in communications, 2014-10, Vol.32 (10), p.1947-1956 資源來源： IEEE Electronic Library (IEL) 版權： Copyright The Institute of Electrical and Electronics Engineers, Inc. (IEEE) Oct 2014 識別號： ISSN: 0733-8716 識別號： EISSN: 1558-0008 識別號： DOI: 10.1109/JSAC.2014.2358814 識別號： CODEN: ISACEM
Appears in Collections:	[Department of Computer Science and information Engineering] journal & Dissertation

Files in This Item:

File	Description	Size	Format
index.html		0Kb	HTML	17	View/Open

社群 sharing

Loading...