Getting Prepared for the Next Botnet Attack: Detecting Algorithmically Generated Domains in Botnet Command and Control

Tim Kelley, Eoghan Furey

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

11 Citations (Scopus)

Abstract

This paper highlights the high noise to signal ratio that DNS traffic poses to network defense' incident detection and response, and the broader topic of the critical time component required from intrusion detection for actionable security intelligence. Nowhere is this truer than in the monitoring and interception of malware command and control communications hidden amongst benign DNS internet traffic. Global ransomware and malware families were responsible for over 5 billion USD in losses. In 4 days Reaper, a Mirai variant, infected 2.7m nodes. The scale of malware infections outstrips information security blacklisting ability to keep pace. Machine learning techniques, such as CLIP, provide the ability to detect malware traffic to malicious command and control domains with high reliability using lexical properties and semantic patterns in algorithmically generated domain names.

Original languageEnglish
Title of host publication29th Irish Signals and Systems Conference, ISSC 2018
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9781538660461
DOIs
Publication statusPublished - 20 Dec 2018
Event29th Irish Signals and Systems Conference, ISSC 2018 - Belfast, United Kingdom
Duration: 21 Jun 201822 Jun 2018

Publication series

Name29th Irish Signals and Systems Conference, ISSC 2018

Conference

Conference29th Irish Signals and Systems Conference, ISSC 2018
Country/TerritoryUnited Kingdom
CityBelfast
Period21/06/1822/06/18

Keywords

  • CC
  • DNS
  • actionable intelligence
  • big data security analytics
  • botnet
  • dga
  • machine learning
  • n-gram

Fingerprint

Dive into the research topics of 'Getting Prepared for the Next Botnet Attack: Detecting Algorithmically Generated Domains in Botnet Command and Control'. Together they form a unique fingerprint.

Cite this