Understanding DNS-based criminal infrastructure for informing takedowns

Botnet takedown;Advanced persistent threat;Network security;DNS

Nadji, Yacin Ibrahim ; Lee, Wenke Antonakakis, Manos Computer Science Blough, Douglas Ahamad, Mustaque Bailey, Michael ; Lee, Wenke

University:Georgia Institute of Technology

Department:Computer Science

关键词: Botnet takedown;    Advanced persistent threat;    Network security;    DNS;   

Others  :  https://smartech.gatech.edu/bitstream/1853/54335/1/NADJI-DISSERTATION-2015.pdf

美国|英语

来源: SMARTech Repository

【 摘 要 】

Botnets are a pervasive threat to the Internet and its inhabitants. A botnetis a collection of infected machines that receive commands from the botmaster, aperson, group or nation- state, to perform malicious actions. Instead of “cleaning”individual infections, one can sever the method of communication between a botmasterand her zombies by attempting a botnet takedown, which contains the botnet andits malicious actions.Unfortunately, takedowns are currently performed without technical rigor nor arethere automated and independent means to measure success or assist in performingthem. This dissertation focuses on understanding the criminal infrastructure thatenables communication between a botmaster and her zombies in order to measureattempts at, and to perform, successful takedowns. We show that by interrogatingmalware and performing large-scale analysis of passively collected network data, wecan measure if a past botnet takedown was successful and use the same techniquesto perform more comprehensive takedowns in the future.