Tracking multiple C&C botnets by analyzing DNS traffic

Jehyun Lee, Jonghun Kwon, Hyo Jeong Shin, Heejo Lee

Research output: Chapter in Book/Report/Conference proceedingConference contribution

11 Citations (Scopus)

Abstract

Botnets have been considered as a main source of Internet threats. A common feature of recent botnets is the use of one or more C&C servers with multiple domain names for the purpose of increasing flexibility and survivability. In contrast with single domain botnets, these multi domain botnets are hard to be quarantined because they change domain names regularly for connecting their C&C server(s). In this paper, we introduce a tracking method of botnets by analyzing the relationship of domain names in DNS traffic generated from botnets. By examining the DNS queries from the clients which accessed the known malicious domain names, we can find a set of unknown malicious domain names and their relationship. This method enables to track malicious domain names and clients duplicately infected by multiple bot codes which make botnets revivable against existing quarantine methods. From the experiments with one hour DNS traffic in an ISP network, we find tens of botnets, and each botnet has tens of malicious domains. In addition to botnet domains, we find a set of other domain names used for spamming or advertising servers. The proposed method can be used for quarantining recent botnets and for limiting their survivability by tracking the change of domain names.

Original languageEnglish
Title of host publication2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010
Pages67-72
Number of pages6
DOIs
Publication statusPublished - 2010 Dec 1
Event2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010 - Kyoto, Japan
Duration: 2010 Oct 52010 Oct 5

Other

Other2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010
CountryJapan
CityKyoto
Period10/10/510/10/5

    Fingerprint

ASJC Scopus subject areas

  • Computer Networks and Communications

Cite this

Lee, J., Kwon, J., Shin, H. J., & Lee, H. (2010). Tracking multiple C&C botnets by analyzing DNS traffic. In 2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010 (pp. 67-72). [5634445] https://doi.org/10.1109/NPSEC.2010.5634445