Tracking multiple C&C botnets by analyzing DNS traffic

Jehyun Lee, Jonghun Kwon, Hyo Jeong Shin, Heejo Lee

Research output: Chapter in Book/Report/Conference proceedingConference contribution

13 Citations (Scopus)


Botnets have been considered as a main source of Internet threats. A common feature of recent botnets is the use of one or more C&C servers with multiple domain names for the purpose of increasing flexibility and survivability. In contrast with single domain botnets, these multi domain botnets are hard to be quarantined because they change domain names regularly for connecting their C&C server(s). In this paper, we introduce a tracking method of botnets by analyzing the relationship of domain names in DNS traffic generated from botnets. By examining the DNS queries from the clients which accessed the known malicious domain names, we can find a set of unknown malicious domain names and their relationship. This method enables to track malicious domain names and clients duplicately infected by multiple bot codes which make botnets revivable against existing quarantine methods. From the experiments with one hour DNS traffic in an ISP network, we find tens of botnets, and each botnet has tens of malicious domains. In addition to botnet domains, we find a set of other domain names used for spamming or advertising servers. The proposed method can be used for quarantining recent botnets and for limiting their survivability by tracking the change of domain names.

Original languageEnglish
Title of host publication2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010
Number of pages6
Publication statusPublished - 2010
Event2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010 - Kyoto, Japan
Duration: 2010 Oct 52010 Oct 5

Publication series

Name2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010


Other2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'Tracking multiple C&C botnets by analyzing DNS traffic'. Together they form a unique fingerprint.

Cite this