Using a massive number of coordinated and distributed machines, botnets have become one of the most sophisticated cyber threats. However, software defined networking leads to more effective mitigation approaches by providing a flexible and dynamic way to control the network. Existing botnet detection approaches fail to detect unknown botnet threats and are time consuming. Facing these shortcomings motivates us to employ honeypots as a competent solution. We propose a novel blocking approach that uses honeypots to detect and efficiently prevent botnet propagation in software defined networks. This approach identifies the relationship among botnet members and intelligently blocks them. We also design and implement a deception system based on our blocking approach with two goals: reducing the botnet infection rate and wasting the adversary’s time. Experimental results, which are based on a real malware, show that our proposed system compared with current blocking approaches can reduce the infection rate up to 25% and increase the adversary’s wasted time by a factor of four. Our system also provides a satisfactory detection performance.

An intelligent botnet blocking approach in software defined networks using honeypots

DNS over HTTPS (DoH) protocol can mitigate the risk of privacy breaches but makes it difficult to control network security services due to the DNS traffic encryption. However, since malicious DNS tunnel tools for the DoH protocol pose network security threats, network administrators need to recognize malicious communications even after the DNS traffic encryption has become widespread. In this paper, we propose a malicious DNS tunnel tool recognition system using persistent DoH traffic analysis based on machine learning. The proposed system can accomplish continuous knowledge updates for emerging malicious DNS tunnel tools on the machine learning model. The system is based on hierarchical machine learning classification and focuses on DoH traffic analysis. The evaluation results confirm that the proposed system is able to recognize the six malicious DNS tunnel tools in total, not only well-known ones, including dns2tcp, dnscat2, and iodine, but also the emerging ones such as dnstt, tcp-over-dns, and tuns with 98.02% classification accuracy. 

/pdf/malicious-dns-tunnel-tool-recognition-using-persistent-doh-233b4dhs.pdf

Malicious DNS Tunnel Tool Recognition using Persistent DoH Traffic Analysis

pdf/ns-record-history-based-abnormal-dns-traffic-detection-301aq4urmh.pdf

NS record History Based Abnormal DNS traffic Detection Considering Adaptive Botnet Communication Blocking

DNS over HTTPS (Do) can mitigate the risk of privacy breaches but makes it difficult to control network security services due to the DNS traffic encryption. However, since malicious DNS tunnel tools for the DoH protocol pose network security threats, network administrators need to recognize malicious communications even after the DNS traffic encryption has become widespread. In this paper, we propose a malicious DNS tunnel tool recognition system using persistent DoH traffic analysis based on machine learning. The proposed system can accomplish continuous knowledge updates for emerging malicious DNS tunnel tools on the machine learning model. The system is based on hierarchical machine learning classification and focuses on DoH traffic analysis. The evaluation results confirm that the proposed system is able to recognize the six malicious DNS tunnel tools in total, not only well-known ones, including dns2tcp, dnscat2, and iodine, but also the emerging ones such as dnstt, tcp-over-dns, and tuns with 98.02% classification accuracy.

Malicious DNS Tunnel Tool Recognition Using Persistent DoH Traffic Analysis

Encrypted domain name resolution can reduce the risk of privacy leakage for Internet users, but it may also prevent network administrators from detecting suspicious communications. Since operating systems supporting DNS over HTTPS (DoH) have increased in recent years, malware that uses Domain Generation Algorithm (DGA) can exploit it to hide the generated domain names. In this paper, we propose a system that detects DGA-based malware communications from DoH traffic. Based on the concept of hierarchical machine learning analysis, the proposed system classifies network traffic with Gradient Boosting Decision Tree (GBDT) and tree-ensemble models. The evaluation confirmed that the system was able to detect DoH traffic generated by PadCrypt, Sisron, Tinba, and Zloader with 99.12% accuracy. The results indicate that the system has the ability to detect different DGA-based malware communications from DoH traffic with sufficient accuracy to support network administrators. 

Detection of DGA-based Malware Communications from DoH Traffic Using Machine Learning Analysis

Cyberattacks by botnets keep on increasing. In this research, we aim to detect and block Domain Generation Algorithm (DGA)-based bot-infected computers by focusing on the characteristics of domain name resolution for searching the Command & Control (C&C) servers. The attackers register only few of the DGA-based domain names for the C&C servers and make the bot-infected computers search them using DNS domain name resolution for the further instructions. This makes the DNS domain name resolution in C&C server searching process inevitably causing NXDOMAIN responses for queries about nonexistence domain names. In this paper, we designed and implemented a detection and blocking system against DGA-based bot-infected computers searching for the C&C servers by analyzing the DNS traffic resulted with NXDOMAIN responses. According to the feature evaluation results, we confirmed that the prototype system was effective for multiple types of DGA-based bots thus the approach could be applicable to detect and block the malicious DNS traffic from the bot-infected computers at the early stage.

Detection and Blocking of DGA-based Bot Infected Computers by Monitoring NXDOMAIN Responses

DNS (Domain Name System)-based name resolution service is one of the most fundamental Internet services for the Internet users and application service providers. In normal DNS based domain name resolution, the corresponding NS records are required in prior to sending DNS query to the corresponding authoritative DNS servers. However, in recent years, DNS based botnet communication has been observed in which botnet related network traffic is transferred via DNS packets. In particular, it is observed in some malware that DNS queries are sent to C&C servers using IP address directly without obtaining the corresponding NS records. In this paper, we propose a novel mechanism to detect and block anomaly DNS traffic by analyzing the achieved NS record history in an organization network. In the proposed mechanism, all DNS traffic of an organization netwok will be captured and analyzed in order to extract the legitimate NS (Name Server) records and the corresponding glue A records (the IP address(es) of a name server) which will be stored in a white list database. Then all the outgoing DNS query packets will be checked and those destined to the IP addresses that not included in the white list will be blocked as anomaly DNS traffic. We have implemented a prototype system and evaluated the functionalities in an SDN-based experimental network. The results show that the prototype system works as expected and the proposed mechanism is capable of detecting and blocking some specific types of suspicious DNS traffic.

Detection and Blocking of Anomaly DNS Traffic by Analyzing Achieved NS Record History

Handle everyday research tasks with reliable, citation-backed results

Your personal Research Agent to handle research tasks with citation-backed results

Popular Tasks used by Researchers

How can I help with your research?

Meet SciSpace

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Yong Jin

Author Tools

Chat about Author

Papers

Detection and Blocking of DGA-based Bot Infected Computers by Monitoring NXDOMAIN Responses

Detection and Blocking of Anomaly DNS Traffic by Analyzing Achieved NS Record History