scholarly journals BotDet: A System for Real Time Botnet Command and Control Traffic Detection

IEEE Access ◽  
2018 ◽  
Vol 6 ◽  
pp. 38947-38958 ◽  
Author(s):  
Ibrahim Ghafir ◽  
Vaclav Prenosil ◽  
Mohammad Hammoudeh ◽  
Thar Baker ◽  
Sohail Jabbar ◽  
...  
Keyword(s):  
Real Time ◽  
Command And Control ◽  
And Control ◽  
Control Traffic ◽  
Traffic Detection

scholarly journals Detecting malware based on expired command-and-control traffic

2017 ◽  
Vol 13 (7) ◽  
pp. 155014771772079 ◽  
Author(s):  
Futai Zou ◽  
Siyu Zhang ◽  
Linsen Li ◽  
Li Pan ◽  
Jianhua Li
Keyword(s):  
Network Security ◽  
High Precision ◽  
Command And Control ◽  
Behavioral Characteristics ◽  
Security Risks ◽  
Domain Name ◽  
Security Environment ◽  
And Control ◽  
Control Traffic ◽  
Domain Name Service

In this article, we analyze the behavioral characteristics of domain name service queries produced by programs and then design an algorithm to detect malware with expired command-and-control domains based on the key feature of domain name service traffic, that is, repeatedly querying domain with a fixed interval. In total, 3027 malware command-and-control domains in the network traffic of Shanghai Jiao Tong University, affecting 249 hosts, were successfully detected, with a high precision of 92.0%. This algorithm can find those malware with expired command-and-control domains that are usually ignored by current research and would have important value for eliminating network security risks and improving network security environment.

Sign in / Sign up

Export Citation Format

Share Document