Abstract
Fast-flux is a kind of DNS technique used by botnets to hide the actual location of malicious servers. It is considered as an emerging threat for information security. In this paper, we propose an approach to detect the fast-flux service network (FFSN) using data mining techniques. Furthermore, we use the resampling technique to solve imbalanced classification problem with respect to FFSNs detection. Experiment results in the real datasets show that our approach improves the detective precision and effectiveness compared with existing researches.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Castelluccia, C., Kaafar, M.A., et al.: Geolocalization of Proxied Services and its Application to Fast-Flux Hidden Servers. In: Proceedings of IMC 2009, November 4-6, pp. 184–189 (2009)
Jose, N., Thorsten, H.: As the Net Churns: Fast-Flux Botnet Observations. In: Proceedings of Int’l Conf, Malicious and Unwanted Software (Malware), pp. 24–31. IEEE Press, Los Alamitos (2008)
ICANN Security and Stability Advisory Committee.: SAC 025: SSA Advisory on Fast Flux Hosting and DNS (March 2008), http://www.icann.org/en/committees/security/ssac-documents.htm
Alper, C., Mike, T., et al.: Real-time detection of fast-flux service networks. In: Cybersecurity Applications & Technology Conference for Homeland Security, pp. 285–292 (2009)
The Honeynet Project.: Know Your Enemy: Fast-Flux Service Networks (2008), http://www.honeynet.org/papers/ff
Caglayan, A., Toothaker, M., et al.: Behavioral analysis of Fast Flux Service Networks. In: CSIIRW 2009, April 13-15 (2009)
Holz, T., Gorecki, C., et al.: Measuring and Detecting Fast-Flux Service Networks. In: Proceedings of the Network & Distributed System Security Symposium (2008)
Emanuele, P., Roberto, P., et al.: Fluxor: detecting and monitoring fast-flux service networks. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol. 5137, pp. 186–206. Springer, Heidelberg (2008)
Wu, J., Zhang, L., et al.: A Comparative Study for Fast-Flux Service Networks Detection. In: Proceeding - 6th International Conference on Networked Computing and Advanced Information Management, NCM, pp. 346–350 (2010)
Sami, A., Yadegari, B., et al.: Malware Detection Based on Mining API Calls. In: Proceedings of SAC 2010, pp. 1020–1025 (2010)
Internet Software Consortium.: Dig: domain information groper (September 2007), http://www.isc.org/sw/bind/
Yu, S., Zhou, S., et al.: Fast-flux Attach Network Identification Based on Agent Lifespan. In: IEEE International Conference on Digital Object Identifier, Wireless Communications, Networking and Information Security (WCNIS), pp. 658–662 (2010)
Do, H.-H., Melnik, S., et al.: Comparision of schema matching evaluations. In: Proceedings of Web, Web-Services and Database Systems, pp. 221–337 (2002)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Chen, Z., Wang, J., Zhou, Y., Li, C. (2011). An Improvement for Fast-Flux Service Networks Detection Based on Data Mining Techniques. In: Kuznetsov, S.O., Ślęzak, D., Hepting, D.H., Mirkin, B.G. (eds) Rough Sets, Fuzzy Sets, Data Mining and Granular Computing. RSFDGrC 2011. Lecture Notes in Computer Science(), vol 6743. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-21881-1_47
Download citation
DOI: https://doi.org/10.1007/978-3-642-21881-1_47
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-21880-4
Online ISBN: 978-3-642-21881-1
eBook Packages: Computer ScienceComputer Science (R0)