基于Fast-Flux的DNS异常行为分析

doi:10.19678/j.issn.1000-3428.0047965

摘要/Abstract

摘要：

研究基于Fast-Flux域名系统(DNS)报文的异常行为,并分析僵尸网络的工作特点,依据大量DNS报文的数据,了解Fast-Flux的攻击特性,找到Fast-Flux攻击的具体特征,识别出DNS流量中的异常数据。通过对DNS数据的综合分析,区分Fast-Flux和频繁更换IP的大型网站,给出Fast-Flux报文存活时间较短、时间差分布平均、请求频繁、IP池等特征,并提出一种报文筛选的算法。分析结果证明,与传统僵尸网络检测方法相比,在报文正确率相同的情况下,该算法实现更加简单,可以准确形容Fast-Flux的攻击行为。

关键词: Fast-Flux攻击, 僵尸网络, 域名系统, 负载躲避, 载流均衡

Abstract:

This paper studies the abnormal behavior of Fast-Flux based on Domain Name System (DNS) packets,analyzes the working characteristics of botnets,learn the attack characteristics of Fast-Flux based on the data of a large number of DNS packets,and finds out the specific characteristics of Fast-Flux attacks.It identifies anomalous data in DNS traffic.Through comprehensive analysis of DNS data,it distinguishes between Fast-Flux and large IP sites with frequent IP changes,and gives Fast-Flux messages with short Time To Live(TTL),average time difference distribution,frequent requests,IP pool,etc.,and proposes a message screening algorithm.Analysis results show that compared with the traditional botnet detection method,the algorithm is simpler and easier to implement and can exactly the describe the Fast-Fulx attack behavior when the message correct rate is the same situation.

Key words: Fast-Flux attack, Botnet, Domain Name System(DNS), load avoidance, current-carrying balance

中图分类号:

TP393

李骜骋,王峥. 基于Fast-Flux的DNS异常行为分析[J]. 计算机工程, 2018, 44(12): 184-189,195.

LI Aocheng,WANG Zheng. Analysis of DNS Anomalous Behaviors Based on Fast-Flux[J]. Computer Engineering, 2018, 44(12): 184-189,195.

https://www.ecice06.com/CN/Y2018/V44/I12/184

参考文献

［1］康乐,李东,余翔湛.基于SVM的Fast-Flux僵尸网络检测技术研究［J］.智能计算机与应用,2011,3(1):24-27.
［2］左晓军,董立勉,曲武.基于域名系统流量的Fast-Flux僵尸网络检测方法［J］.计算机工程,2017,43(9):185-193.
［3］ALIEYAN K,ALMOMNI A,MANASRAH A,et al.A survey of botnet detection based on DNS［J］.Neural Computing and Applications,2017,28(7):1541-1558.
［4］CAGLAYAN A,TOOTHAKER M,DRAPEAU D,et al.Behavioral analysis of botnets for threat intelligence［J］.Information Systems and e-Business Management,2012,10(4):491-519.
［5］李青山,陈钟.Domain-flux僵尸网络域名检测［J］.计算机工程与设计,2012,33(8):2915-2919.
［6］GU G,PERDISCI R,AHANG J,et al.Bot miner:clustering analysis of network traffic for protocol and structure in dependent Botnet detection［C］//Proceedings of the 17th IEEE Conference on Security Symposium.San Jose,USA:［s.n.］,2008:139-154.
［7］WANG P,WU L,ASLAM B,et al.A systematic study on peer-to-peer Botnets［C］//Proceedings of International Conference on Computer Communications and Networks.［S.1.］:IEEE Computer Society,2009:1-8.
［8］PRASAD K M,REDDY A R M,KARTHIK M G.Flooding attacks to Internet threat monitors:modeling and counter measures using Botnet and honeypots［J］.International Journal of Computer Science and Information Technology,2012,3(6):159-172.
［9］FUTA I,ZHANG S,et al.Hybrid detection and tracking of fast-flux Botnet on domain name system traffic［J］.China Communications,2013,10(11):81-94.
［10］OTGONBOLD T.ADAPT:an anonymous,distributed,and active probing-based technique for detecting malicious fast-flux domains［EB/OL］.［2017-06-12］.https://search.proquest.com/docview/1659794561.
(下转第195页)
(上接第189页)
［11］KOO T M,CHANG H C,CHUANG C C.Detecting and analyzing fast-flux service networks［J］.Advances in Information Sciences and Service Sciences,2012,4(10):183-190.
［12］KOO T M,CHANG H C,SU W H.Building a P2P Botnet based on a new key management scheme［J］.Advances in Information Sciences and Service Sciences,2012,4(5):199-207.
［13］HOLE T,GORECKI C,RIECK K,et al.Measuring and detecting fast-flux service networks［C］//Proceedings of Network and Distributed System Security Symposium.San Diego,USA:［s.n.］,2008:487-492.
［14］ALMOMANI A,GUPTA B B,ATAWNEH S,et al.A survey of phishing email filtering techniques［J］.IEEE Communications Surveys and Tutorials,2013,15(4):2070-2090.
［15］KONTE M,FEAMSTER N,JUNG J.Dynamics of online scam hosting infrastructure［C］//Proceedings of International Conference on Passive and Active Network Measurement.Berlin,Germany:Springer,2009:219-228.
［16］HSU C H,HUANG C Y,CHEN K T.Fast-flux bot detection in real time［C］//Proceedings of International Conference on Recent Advances in Intrusion Detection.Berlin,Germany:Springer,2010:464-483.
［17］PERDISCI R,CORONA I,DAGON D,et al.Detecting malicious flux service networks through passive analysis of recursive DNS traces［C］//Proceedings of Computer Security Applications Conference.［S.1.］:IEEE Computer Society,2009:311-320.
［18］ALDUWAIRI B N,ALHAMMOURI A T.Fast flux watch:a mechanism for online detection of fast flux networks［J］.Journal of Advanced Research,2014,5(4):473-479.
［19］MARTINEZ-BEA S,CASTILLO-PEREZ S.Real-time malicious fast-flux detection using DNS and bot related features［C］//Proceedings of the 11th International Conference on Privacy,Security and Trust.Washington D.C.,USA:IEEE Press,2013:369-372.
［20］CAGLIYAN A,TOOTHAKER M,DAN D,et al.Real-time detection of fast flux service networks［C］//Proceedings of Cybersecurity Applications and Technology Conference on Homeland Security.［S.1.］:IEEE Computer Society,2009:285-292.

[1]	葛昕, 邹福泰, 郭万达, 谭越, 李林森. 社交僵尸网络发展综述[J]. 计算机工程, 2022, 48(8): 12-24.
[2]	胡斌, 周志洪, 姚立红, 李建华. 结合报文负载与流指纹特征的恶意流量检测[J]. 计算机工程, 2020, 46(11): 157-163.
[3]	叶崛宇, 岳巧丽, 王骞, 张海阔. 基于超级账本的DNS协同防御体系研究[J]. 计算机工程, 2019, 45(11): 24-31.
[4]	李大伟. 通用僵尸网络实验平台设计[J]. 计算机工程, 2018, 44(11): 123-128.
[5]	陈瑞东,赵凌园,张小松. 基于模糊聚类的僵尸网络识别技术[J]. 计算机工程, 2018, 44(10): 46-50.
[6]	左晓军,董立勉,曲武. 基于域名系统流量的Fast-Flux僵尸网络检测方法[J]. 计算机工程, 2017, 43(9): 185-193.
[7]	李景,姚一杨,卢新岱,乔勇. 基于Challenge策略的大规模恶意P2P僵尸节点检测技术[J]. 计算机工程, 2016, 42(10): 158-163.
[8]	白涛,刘成龙,曲武,王震. 基于网络流量异常的僵尸网络受控主机检测研究[J]. 计算机工程, 2015, 41(11): 170-179.
[9]	刘明星,金键,李晓东. 基于机器学习的域名数据监控方法[J]. 计算机工程, 2014, 40(9): 263-268.
[10]	邵秀丽，蒋鸿玲，耿梅洁，李耀芳. 基于关联关系和MapReduce的僵尸网络检测[J]. 计算机工程, 2014, 40(5): 115-119.
[11]	成淑萍,谭良. 基于网络流量的僵尸网络动态检测模型[J]. 计算机工程, 2014, 40(11): 106-112.
[12]	许成喜, 胡荣贵, 施凡, 张岩庆. Kaminsky域名系统缓存投毒防御策略研究[J]. 计算机工程, 2013, 39(1): 12-17.
[13]	欧阳晨星, 谭良, 朱贵琼. 基于无尺度网络的僵尸网络传播模型[J]. 计算机工程, 2012, 38(5): 126-128,132.
[14]	李鹤帅, 朱俊虎, 周天阳, 王清贤. P2P技术在僵尸网络中的应用研究[J]. 计算机工程, 2012, 38(14): 1-4.
[15]	黄彪, 谭良. 无尺度半分布式P2P僵尸网络的构建[J]. 计算机工程, 2012, 38(11): 130-132.

选择文件类型/文献管理软件名称

选择包含的内容