关于使用DNS进行命令和控制的僵尸网络

2011 Seventh European Conference on Computer Network Defense Pub Date : 2011-09-06 DOI:10.1109/EC2ND.2011.16

Christian J. Dietrich, C. Rossow, F. Freiling, H. Bos, M. Steen, N. Pohlmann

{"title":"关于使用DNS进行命令和控制的僵尸网络","authors":"Christian J. Dietrich, C. Rossow, F. Freiling, H. Bos, M. Steen, N. Pohlmann","doi":"10.1109/EC2ND.2011.16","DOIUrl":null,"url":null,"abstract":"We discovered and reverse engineered Feederbot, a botnet that uses DNS as carrier for its command and control. Using k-Means clustering and a Euclidean Distance based classifier, we correctly classified more than 14m DNS transactions of 42,143 malware samples concerning DNS-C&C usage, revealing another bot family with DNS C&C. In addition, we correctly detected DNS C&C in mixed office workstation network traffic.","PeriodicalId":404689,"journal":{"name":"2011 Seventh European Conference on Computer Network Defense","volume":"330 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2011-09-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"141","resultStr":"{\"title\":\"On Botnets That Use DNS for Command and Control\",\"authors\":\"Christian J. Dietrich, C. Rossow, F. Freiling, H. Bos, M. Steen, N. Pohlmann\",\"doi\":\"10.1109/EC2ND.2011.16\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"We discovered and reverse engineered Feederbot, a botnet that uses DNS as carrier for its command and control. Using k-Means clustering and a Euclidean Distance based classifier, we correctly classified more than 14m DNS transactions of 42,143 malware samples concerning DNS-C&C usage, revealing another bot family with DNS C&C. In addition, we correctly detected DNS C&C in mixed office workstation network traffic.\",\"PeriodicalId\":404689,\"journal\":{\"name\":\"2011 Seventh European Conference on Computer Network Defense\",\"volume\":\"330 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2011-09-06\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"141\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"2011 Seventh European Conference on Computer Network Defense\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1109/EC2ND.2011.16\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"2011 Seventh European Conference on Computer Network Defense","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/EC2ND.2011.16","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 141

摘要

我们发现并对feedbot进行了逆向工程，这是一个使用DNS作为其命令和控制载体的僵尸网络。使用k-Means聚类和基于欧几里得距离的分类器，我们正确分类了42,143个关于DNS-C&C使用的恶意软件样本的超过14m个DNS交易，揭示了另一个具有DNS C&C的机器人家族。此外，我们在混合办公工作站网络流量中正确检测到DNS C&C。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

查看原文本刊更多论文

On Botnets That Use DNS for Command and Control

We discovered and reverse engineered Feederbot, a botnet that uses DNS as carrier for its command and control. Using k-Means clustering and a Euclidean Distance based classifier, we correctly classified more than 14m DNS transactions of 42,143 malware samples concerning DNS-C&C usage, revealing another bot family with DNS C&C. In addition, we correctly detected DNS C&C in mixed office workstation network traffic.

求助全文

通过发布文献求助，成功后即可免费获取论文全文。去求助

来源期刊

2011 Seventh European Conference on Computer Network Defense

自引率

0.00%

发文量