SlideShare a Scribd company logo

nullcon 2011 - Botnet Detection approach by DNS behavior and clustering analysis

Download as PPTX, PDF
n|u - The Open Security Community, profile picture
n|u - The Open Security Community

The document presents a botnet detection system leveraging DNS behavior and clustering analysis to identify botnets, which are networks of compromised computers used for malicious activities. It outlines the prevalence of botnets, detailing recruitment rates of new bots and the limitations of traditional detection methods. The proposed methodology utilizes DNS data and k-means clustering to effectively detect fast-flux characteristics associated with botnets, demonstrating promising results with low false positives in real-world evaluations.

Technology
1 of 32
Downloaded 86 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
Botnet Detection System using DNS behaviour and clustering analysisPresented by Nilesh SharmaPulkitMehndirattaIndraprashta Institute of Information Technology, Delhi(IIIT- DELHI)http://null.co.in
Who we are….?M.tech (pursuing) from the IIIT- DelhiResearch Interests-BotnetsCyber ForensicsPrivacy enhancive technologiesCryptographic techniquesPart of IIITD-ACM student chapterhttp://null.co.in
What Is a Bot/Botnet?Bot – A malware instance that runs autonomously and automatically on a compromised computer (zombie) without owner’s consent.Botnet (Bot Army): network of bots controlled by criminals- “A coordinated group of malware instances that are controlled by a botmaster via some C&C channel”.– “25% of Internet PCs are part of a botnet!” ( - Vint Cerf)http://null.co.in
Botnets are used for…. All DDoS attacks
Spam
Click fraud
Information theft
Phishing attacks
Distributing other malware, e.g., spywarehttp://null.co.in
How big is this problem?The size and prevalence of the botnet reported as many as 172,000 new bots recruited every day according to CipherTrust.which means about 5 million new bots are appeared every month. Symantec recently reported that the number of bots observed in a day is 30,000 on average.The total number of bot infected systems has been measured to be between 800,000 to 900,000. A single botnet comprised of more than 140,000 hosts was found in the wild and botnet driven attacks have been responsible for single DDoS attacks of more than 10Gbps capacity.http://null.co.in
Conflicker according to McAfeeWhen executed, the worm copies itself using a random name to the %Sysdir% folder.Obtains the public ip address of the affected computer. Attempts to download a malware file from the remote website Starts a HTTP server on a random port on the infected machine to host a copy of the worm. Continuously scans the subnet of the infected host for vulnerable machines and executes the exploit. http://null.co.in
Difference between a Virus ,Worm and Botnets….E:\nilesh _back up\academics\dss project\New Folder\botnet explained.flvhttp://null.co.in
Existing TechniquesTraditional Anti Virus tools – Bots use packer, rootkit, frequent updating to easily defeat Anti Virus toolsHoneypot – Not a good botnet detection toolhttp://null.co.in
Challenges for Botnet DetectionSelection of Network Monitoring ToolClustering AlgorithmHeuristics for clustering algorithmThe fast flux. False PositivesGraphical User InterfaceLooking for dynamic approach as static and signature based approaches may not be effective.http://null.co.in
Related WorkBotnet Detection by Monitoring Group Activities in DNS Traffic :HyunsangChoi, Hanwoo Lee, Heejo Lee, Hyogon Kim Korea University.BotHunter [Guetal Security’07]: dialog correlation to detect bots based on an infection dialog modelBotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (GuofeiGu Georgia Institute of Technology) http://null.co.in
MotivationBotnets can change their C&C content (encryption, etc.), protocols (IRC, HTTP, etc.), structures (P2P, etc.), C&C servers.http://null.co.in
Again Botnet…..“A coordinated group of malware instances that are controlled by a botmaster via some C&C channel”http://null.co.in
The Framework….http://null.co.in
MethodologyCollect the DNS data from wireshark and change it into .csv file format using Logparser tool through a GUI toolInsert the infected data(looks like botnet, having the fast flux characteristics).Retrieve the DNS name and its respective IP addresses from the packet information(.csv file).Perform the K-means clustering on the data on the basis of DNS name and try to find out that whether we are being able to detect botnetfastflux or not?http://null.co.in
Demonstration of Methodologyhttp://null.co.in
Results (k=50 clusters)http://null.co.in
Results (k=100 clusters)
Results (k=150 clusters)
Results (k=200 clusters)
False Negative Analysishttp://null.co.in
Detection Rate Analysis
Resultshttp://null.co.in
Real world fast-flux examplesDNS Basics-A RecordA records (also known as host records) are the central records of DNS. These records link a domain, or subdomain, to an IP address. A records and IP addresses do not necessarily match on a one-to-one basis. Many A records correspond to a single IP address, where one machine can serve many web sites. Alternatively, a single A record may correspond to many IP addresses. This can facilitate fault tolerance and load distribution, and allows a site to move its physical location. http://null.co.in
Real world fast-flux examplesNS records-Name server records determine which servers will communicate DNS information for a domain. Two NS records must be defined for each domain. Generally, you will have a primary and a secondary name server record - NS records are updated with your domain registrar and will take 24-72 hours to take effect. If your domain registrar is separate from your domain host, your host will provide two name servers that you can use to update your NS records with your registrar. http://null.co.in
REAL WORLD FAST-FLUX EXAMPLESCredit Money Botnet- Zeus BotnetBelow are the single-flux DNS records typical of such an infrastructure. The tables show DNS snapshots of the domain name divewithsharks.hk taken approximately every 30 minutes, with the five A records returned round-robin showing clear infiltration into home/business dialup and broadband networks. Notice that the NS records do not change, but some of the A records do. This is the money mule bot example. divewithsharks.hk. 1800 IN A 70.68.187.xxx [xxx.vf.shawcable.net]divewithsharks.hk. 1800 IN A 76.209.81.xxx [SBIS-AS - AT&T Internet Services]divewithsharks.hk. 1800 IN A 85.207.74.xxx [adsl-ustixxx-74-207-85.bluetone.cz]divewithsharks.hk. 1800 IN A 90.144.43.xxx [d90-144-43-xxx.cust.tele2.fr]divewithsharks.hk. 1800 IN A 142.165.41.xxx [142-165-41-xxx.msjw.hsdb.sasknet.sk.ca] divewithsharks.hk. 1800 IN NS ns1.world-wr.com.divewithsharks.hk. 1800 IN NS ns2.world-wr.com.ns1.world-wr.com.  87169 IN A 66.232.119.212 [HVC-AS - HIVELOCITY VENTURES CORP]ns2.world-wr.com.  87177 IN A 209.88.199.xxx [vpdn-dsl209-88-199-xxx.alami.net]http://null.co.in
REAL WORLD FAST-FLUX EXAMPLESfast-flux nets appear to apply some form of logic in deciding which of their available IP addresses will be advertised in the next set of responses. This may be based on ongoing connection quality monitoring (and perhaps a load-balancing algorithm). New flux-agent IP addresses are inserted into the fast-flux service network to replace nodes with poor performance, being subject to mitigation or otherwise offline nodes. divewithsharks.hk. 1800 IN A 24.85.102.xxx [xxx.vs.shawcable.net] NEWdivewithsharks.hk. 1800 IN A 69.47.177.xxx [d47-69-xxx-177.try.wideopenwest.com] NEWdivewithsharks.hk. 1800 IN A 70.68.187.xxx [xxx.vf.shawcable.net]divewithsharks.hk. 1800 IN A 90.144.43.xxx [d90-144-43-xxx.cust.tele2.fr]divewithsharks.hk. 1800 IN A 142.165.41.xxx [142-165-41-xxx.msjw.hsdb.sasknet.sk.ca] divewithsharks.hk. 1800 IN NS ns1.world-wr.com.divewithsharks.hk. 1800 IN NS ns2.world-wr.com.ns1.world-wr.com.  85248 IN A 66.232.119.xxx [HVC-AS - HIVELOCITY VENTURES CORP]ns2.world-wr.com.  82991 IN A 209.88.199.xxx [vpdn-dsl209-88-199-xxx.alami.net]http://null.co.in
REAL WORLD FAST-FLUX EXAMPLESAs we see, highlighted in bold two of the advertised IP addresses have changed. Again, these two IP addresses belong to dial-up or broadband networks. Another 30 minutes later, a lookup of the domain returns the following information: divewithsharks.hk. 1238 IN A 68.150.25.xxx [xxx.ed.shawcable.net] NEWdivewithsharks.hk. 1238 IN A 76.209.81.xxx [SBIS-AS - AT&T Internet Services] This one came back!divewithsharks.hk. 1238 IN A 172.189.83.xxx [xxx.ipt.aol.com] NEWdivewithsharks.hk. 1238 IN A 200.115.195.xxx [pcxxx.telecentro.com.ar] NEWdivewithsharks.hk. 1238 IN A 213.85.179.xxx [CNT Autonomous System] NEW divewithsharks.hk. 1238 IN NS ns1.world-wr.com.divewithsharks.hk. 1238 IN NS ns2.world-wr.com.ns1.world-wr.com.  83446 IN A 66.232.119.xxx [HVC-AS - HIVELOCITY VENTURES CORP]ns2.world-wr.com.  81189 IN A 209.88.199.xxx [vpdn-dsl209-88-199-xxx.alami.net]Now, we observe four new IP addresses and one IP address that we saw in the first query. This demonstrates the round-robin address response mechanism used in fast-flux networks. As we have seen in this example, the A records for the domain are constantly changing. Each one of these systems represents a compromised host acting as a redirector, a redirector that eventually points to the money mule botnethttp://null.co.in

More Related Content

PPTX
Incident response: Advanced Network Forensics
Napier University
 
PDF
SANS Holiday Hack 2013 – Investigation Timeline
giacomo83m
 
PDF
Windows persistence presentation
OlehLevytskyi1
 
PPTX
SIEM
Napier University
 
PPTX
Incident Response: Tunnelling
Napier University
 
PDF
Botnetsand applications
UltraUploader
 
PDF
Fast Detection of New Malicious Domains using DNS
OpenDNS
 
PDF
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
OpenDNS
 
Incident response: Advanced Network Forensics
Napier University
 
SANS Holiday Hack 2013 – Investigation Timeline
giacomo83m
 
Windows persistence presentation
OlehLevytskyi1
 
SIEM
Napier University
 
Incident Response: Tunnelling
Napier University
 
Botnetsand applications
UltraUploader
 
Fast Detection of New Malicious Domains using DNS
OpenDNS
 
Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...
OpenDNS
 

Viewers also liked (10)

PPT
Botnet Detection Techniques
Team Firefly
 
PDF
BOTNET
Arjo Ghosh
 
PDF
Botnets behavioral patterns in the network. A Machine Learning study of botne...
Czech Technical University in Prague
 
PPTX
Botnets 101
Aung Thu Rha Hein
 
DOCX
Construction Challenges For Bridges In Hilly Areas
Shantanu Patil
 
PPTX
challanges made for construction of bridge in hilly areas
Swapnali Kunjir
 
PPTX
Bridges in Hilly areas seminar
Abhinav Pateriya
 
PPTX
Sky x technology
maulik610
 
PPTX
SKY X TECHNOLOGY
Udirmaan Deka
 
PPTX
Sky x Technology (Pranav)
Pranav Bharti
 
Botnet Detection Techniques
Team Firefly
 
BOTNET
Arjo Ghosh
 
Botnets behavioral patterns in the network. A Machine Learning study of botne...
Czech Technical University in Prague
 
Botnets 101
Aung Thu Rha Hein
 
Construction Challenges For Bridges In Hilly Areas
Shantanu Patil
 
challanges made for construction of bridge in hilly areas
Swapnali Kunjir
 
Bridges in Hilly areas seminar
Abhinav Pateriya
 
Sky x technology
maulik610
 
SKY X TECHNOLOGY
Udirmaan Deka
 
Sky x Technology (Pranav)
Pranav Bharti
 
Ad

Similar to nullcon 2011 - Botnet Detection approach by DNS behavior and clustering analysis (20)

PPTX
Seminar on Botnet Detection
Dr. Manmeet Singh
 
PDF
Untitled document.pdf
google
 
PDF
about botnets
Alain Bindele
 
PDF
Botnet Attacks How They Work and How to Defend Against Them.pdf
uzair
 
PPTX
Fast flux
Swapnil Patil
 
PPTX
BOTLAB excersise
Anthony Stamm
 
PDF
Uncovering and Visualizing Botnet Infrastructure and Behavior
Andrea Scarfo
 
PPTX
An Evolving Era of Botnet Empires @ BSides Las Vegas
Andrea Scarfo
 
PPTX
Botnet
PriyanKa Harjai
 
PPTX
Botnet and its Detection Techniques
SafiUllah Saikat
 
PDF
CNIT 40: 4: Monitoring and detecting security breaches
Sam Bowne
 
PDF
CNIT 40: 4: Monitoring and detecting security breaches
Sam Bowne
 
PDF
A Survey of Botnet Detection Techniques
ijsrd.com
 
PPTX
Hacker Halted 2014 - Why Botnet Takedowns Never Work, Unless It’s a SmackDown!
EC-Council
 
PDF
The Spammer, the Botmaster, and the Researcher: On the Arms Race in Spamming ...
Gianluca Stringhini
 
PPTX
PHDAYS: DGAs and Threat Intelligence
John Bambenek
 
PDF
Botnets - Detection and Mitigation
Ajit Skanda Kumaraswamy
 
PPT
Defending Against Botnets
Jim Lippard
 
PDF
deftcon 2015 - Dave Piscitello - DNS Traffic Monitoring
Deft Association
 
PDF
A Taxonomy of Botnet Detection Approaches
Fabrizio Farinacci
 
Seminar on Botnet Detection
Dr. Manmeet Singh
 
Untitled document.pdf
google
 
about botnets
Alain Bindele
 
Botnet Attacks How They Work and How to Defend Against Them.pdf
uzair
 
Fast flux
Swapnil Patil
 
BOTLAB excersise
Anthony Stamm
 
Uncovering and Visualizing Botnet Infrastructure and Behavior
Andrea Scarfo
 
An Evolving Era of Botnet Empires @ BSides Las Vegas
Andrea Scarfo
 
Botnet
PriyanKa Harjai
 
Botnet and its Detection Techniques
SafiUllah Saikat
 
CNIT 40: 4: Monitoring and detecting security breaches
Sam Bowne
 
CNIT 40: 4: Monitoring and detecting security breaches
Sam Bowne
 
A Survey of Botnet Detection Techniques
ijsrd.com
 
Hacker Halted 2014 - Why Botnet Takedowns Never Work, Unless It’s a SmackDown!
EC-Council
 
The Spammer, the Botmaster, and the Researcher: On the Arms Race in Spamming ...
Gianluca Stringhini
 
PHDAYS: DGAs and Threat Intelligence
John Bambenek
 
Botnets - Detection and Mitigation
Ajit Skanda Kumaraswamy
 
Defending Against Botnets
Jim Lippard
 
deftcon 2015 - Dave Piscitello - DNS Traffic Monitoring
Deft Association
 
A Taxonomy of Botnet Detection Approaches
Fabrizio Farinacci
 
Ad

More from n|u - The Open Security Community (20)

PDF
Hardware security testing 101 (Null - Delhi Chapter)
n|u - The Open Security Community
 
PDF
Osint primer
n|u - The Open Security Community
 
PPTX
SSRF exploit the trust relationship
n|u - The Open Security Community
 
PPTX
Nmap basics
n|u - The Open Security Community
 
PDF
Metasploit primary
n|u - The Open Security Community
 
PDF
Api security-testing
n|u - The Open Security Community
 
PDF
Introduction to TLS 1.3
n|u - The Open Security Community
 
PDF
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
n|u - The Open Security Community
 
PDF
Talking About SSRF,CRLF
n|u - The Open Security Community
 
PPTX
Building active directory lab for red teaming
n|u - The Open Security Community
 
PPTX
Owning a company through their logs
n|u - The Open Security Community
 
PPTX
Introduction to shodan
n|u - The Open Security Community
 
PDF
Cloud security
n|u - The Open Security Community
 
PDF
Detecting persistence in windows
n|u - The Open Security Community
 
PPTX
Frida - Objection Tool Usage
n|u - The Open Security Community
 
PDF
OSQuery - Monitoring System Process
n|u - The Open Security Community
 
PDF
DevSecOps Jenkins Pipeline -Security
n|u - The Open Security Community
 
PDF
Extensible markup language attacks
n|u - The Open Security Community
 
PPTX
Linux for hackers
n|u - The Open Security Community
 
PDF
Android Pentesting
n|u - The Open Security Community
 
Hardware security testing 101 (Null - Delhi Chapter)
n|u - The Open Security Community
 
Osint primer
n|u - The Open Security Community
 
SSRF exploit the trust relationship
n|u - The Open Security Community
 
Nmap basics
n|u - The Open Security Community
 
Metasploit primary
n|u - The Open Security Community
 
Api security-testing
n|u - The Open Security Community
 
Introduction to TLS 1.3
n|u - The Open Security Community
 
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
n|u - The Open Security Community
 
Talking About SSRF,CRLF
n|u - The Open Security Community
 
Building active directory lab for red teaming
n|u - The Open Security Community
 
Owning a company through their logs
n|u - The Open Security Community
 
Introduction to shodan
n|u - The Open Security Community
 
Cloud security
n|u - The Open Security Community
 
Detecting persistence in windows
n|u - The Open Security Community
 
Frida - Objection Tool Usage
n|u - The Open Security Community
 
OSQuery - Monitoring System Process
n|u - The Open Security Community
 
DevSecOps Jenkins Pipeline -Security
n|u - The Open Security Community
 
Extensible markup language attacks
n|u - The Open Security Community
 
Linux for hackers
n|u - The Open Security Community
 
Android Pentesting
n|u - The Open Security Community
 

Recently uploaded (20)

PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
PPTX
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
PPTX
ACSFv1EN-58255 AWS Academy Cloud Security Foundations.pptx
23bcla24
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PDF
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
PPT
“AI and Expert System Decision Support & Business Intelligence Systems”
ZubinRadhakrishnan
 
PDF
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
PPTX
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PPTX
sap open course for s4hana steps from ECC to s4
sreeni2106invites
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
Understanding_Digital_Forensics_Presentation.pptx
ImranKhan423233
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
ACSFv1EN-58255 AWS Academy Cloud Security Foundations.pptx
23bcla24
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
“AI and Expert System Decision Support & Business Intelligence Systems”
ZubinRadhakrishnan
 
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
Approach and Philosophy of On baking technology
30anthuong17
 
sap open course for s4hana steps from ECC to s4
sreeni2106invites
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 

nullcon 2011 - Botnet Detection approach by DNS behavior and clustering analysis

  • 1. Botnet Detection System using DNS behaviour and clustering analysisPresented by Nilesh SharmaPulkitMehndirattaIndraprashta Institute of Information Technology, Delhi(IIIT- DELHI)http://null.co.in
  • 2. Who we are….?M.tech (pursuing) from the IIIT- DelhiResearch Interests-BotnetsCyber ForensicsPrivacy enhancive technologiesCryptographic techniquesPart of IIITD-ACM student chapterhttp://null.co.in
  • 3. What Is a Bot/Botnet?Bot – A malware instance that runs autonomously and automatically on a compromised computer (zombie) without owner’s consent.Botnet (Bot Army): network of bots controlled by criminals- “A coordinated group of malware instances that are controlled by a botmaster via some C&C channel”.– “25% of Internet PCs are part of a botnet!” ( - Vint Cerf)http://null.co.in
  • 4. Botnets are used for…. All DDoS attacks
  • 9. Distributing other malware, e.g., spywarehttp://null.co.in
  • 10. How big is this problem?The size and prevalence of the botnet reported as many as 172,000 new bots recruited every day according to CipherTrust.which means about 5 million new bots are appeared every month. Symantec recently reported that the number of bots observed in a day is 30,000 on average.The total number of bot infected systems has been measured to be between 800,000 to 900,000. A single botnet comprised of more than 140,000 hosts was found in the wild and botnet driven attacks have been responsible for single DDoS attacks of more than 10Gbps capacity.http://null.co.in
  • 11. Conflicker according to McAfeeWhen executed, the worm copies itself using a random name to the %Sysdir% folder.Obtains the public ip address of the affected computer. Attempts to download a malware file from the remote website Starts a HTTP server on a random port on the infected machine to host a copy of the worm. Continuously scans the subnet of the infected host for vulnerable machines and executes the exploit. http://null.co.in
  • 12. Difference between a Virus ,Worm and Botnets….E:\nilesh _back up\academics\dss project\New Folder\botnet explained.flvhttp://null.co.in
  • 13. Existing TechniquesTraditional Anti Virus tools – Bots use packer, rootkit, frequent updating to easily defeat Anti Virus toolsHoneypot – Not a good botnet detection toolhttp://null.co.in
  • 14. Challenges for Botnet DetectionSelection of Network Monitoring ToolClustering AlgorithmHeuristics for clustering algorithmThe fast flux. False PositivesGraphical User InterfaceLooking for dynamic approach as static and signature based approaches may not be effective.http://null.co.in
  • 15. Related WorkBotnet Detection by Monitoring Group Activities in DNS Traffic :HyunsangChoi, Hanwoo Lee, Heejo Lee, Hyogon Kim Korea University.BotHunter [Guetal Security’07]: dialog correlation to detect bots based on an infection dialog modelBotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (GuofeiGu Georgia Institute of Technology) http://null.co.in
  • 16. MotivationBotnets can change their C&C content (encryption, etc.), protocols (IRC, HTTP, etc.), structures (P2P, etc.), C&C servers.http://null.co.in
  • 17. Again Botnet…..“A coordinated group of malware instances that are controlled by a botmaster via some C&C channel”http://null.co.in
  • 19. MethodologyCollect the DNS data from wireshark and change it into .csv file format using Logparser tool through a GUI toolInsert the infected data(looks like botnet, having the fast flux characteristics).Retrieve the DNS name and its respective IP addresses from the packet information(.csv file).Perform the K-means clustering on the data on the basis of DNS name and try to find out that whether we are being able to detect botnetfastflux or not?http://null.co.in
  • 21. Results (k=50 clusters)http://null.co.in
  • 22. Results (k=100 clusters)
  • 23. Results (k=150 clusters)
  • 24. Results (k=200 clusters)
  • 28. Real world fast-flux examplesDNS Basics-A RecordA records (also known as host records) are the central records of DNS. These records link a domain, or subdomain, to an IP address. A records and IP addresses do not necessarily match on a one-to-one basis. Many A records correspond to a single IP address, where one machine can serve many web sites. Alternatively, a single A record may correspond to many IP addresses. This can facilitate fault tolerance and load distribution, and allows a site to move its physical location. http://null.co.in
  • 29. Real world fast-flux examplesNS records-Name server records determine which servers will communicate DNS information for a domain. Two NS records must be defined for each domain. Generally, you will have a primary and a secondary name server record - NS records are updated with your domain registrar and will take 24-72 hours to take effect. If your domain registrar is separate from your domain host, your host will provide two name servers that you can use to update your NS records with your registrar. http://null.co.in
  • 30. REAL WORLD FAST-FLUX EXAMPLESCredit Money Botnet- Zeus BotnetBelow are the single-flux DNS records typical of such an infrastructure. The tables show DNS snapshots of the domain name divewithsharks.hk taken approximately every 30 minutes, with the five A records returned round-robin showing clear infiltration into home/business dialup and broadband networks. Notice that the NS records do not change, but some of the A records do. This is the money mule bot example. divewithsharks.hk. 1800 IN A 70.68.187.xxx [xxx.vf.shawcable.net]divewithsharks.hk. 1800 IN A 76.209.81.xxx [SBIS-AS - AT&T Internet Services]divewithsharks.hk. 1800 IN A 85.207.74.xxx [adsl-ustixxx-74-207-85.bluetone.cz]divewithsharks.hk. 1800 IN A 90.144.43.xxx [d90-144-43-xxx.cust.tele2.fr]divewithsharks.hk. 1800 IN A 142.165.41.xxx [142-165-41-xxx.msjw.hsdb.sasknet.sk.ca] divewithsharks.hk. 1800 IN NS ns1.world-wr.com.divewithsharks.hk. 1800 IN NS ns2.world-wr.com.ns1.world-wr.com.  87169 IN A 66.232.119.212 [HVC-AS - HIVELOCITY VENTURES CORP]ns2.world-wr.com.  87177 IN A 209.88.199.xxx [vpdn-dsl209-88-199-xxx.alami.net]http://null.co.in
  • 31. REAL WORLD FAST-FLUX EXAMPLESfast-flux nets appear to apply some form of logic in deciding which of their available IP addresses will be advertised in the next set of responses. This may be based on ongoing connection quality monitoring (and perhaps a load-balancing algorithm). New flux-agent IP addresses are inserted into the fast-flux service network to replace nodes with poor performance, being subject to mitigation or otherwise offline nodes. divewithsharks.hk. 1800 IN A 24.85.102.xxx [xxx.vs.shawcable.net] NEWdivewithsharks.hk. 1800 IN A 69.47.177.xxx [d47-69-xxx-177.try.wideopenwest.com] NEWdivewithsharks.hk. 1800 IN A 70.68.187.xxx [xxx.vf.shawcable.net]divewithsharks.hk. 1800 IN A 90.144.43.xxx [d90-144-43-xxx.cust.tele2.fr]divewithsharks.hk. 1800 IN A 142.165.41.xxx [142-165-41-xxx.msjw.hsdb.sasknet.sk.ca] divewithsharks.hk. 1800 IN NS ns1.world-wr.com.divewithsharks.hk. 1800 IN NS ns2.world-wr.com.ns1.world-wr.com.  85248 IN A 66.232.119.xxx [HVC-AS - HIVELOCITY VENTURES CORP]ns2.world-wr.com.  82991 IN A 209.88.199.xxx [vpdn-dsl209-88-199-xxx.alami.net]http://null.co.in
  • 32. REAL WORLD FAST-FLUX EXAMPLESAs we see, highlighted in bold two of the advertised IP addresses have changed. Again, these two IP addresses belong to dial-up or broadband networks. Another 30 minutes later, a lookup of the domain returns the following information: divewithsharks.hk. 1238 IN A 68.150.25.xxx [xxx.ed.shawcable.net] NEWdivewithsharks.hk. 1238 IN A 76.209.81.xxx [SBIS-AS - AT&T Internet Services] This one came back!divewithsharks.hk. 1238 IN A 172.189.83.xxx [xxx.ipt.aol.com] NEWdivewithsharks.hk. 1238 IN A 200.115.195.xxx [pcxxx.telecentro.com.ar] NEWdivewithsharks.hk. 1238 IN A 213.85.179.xxx [CNT Autonomous System] NEW divewithsharks.hk. 1238 IN NS ns1.world-wr.com.divewithsharks.hk. 1238 IN NS ns2.world-wr.com.ns1.world-wr.com.  83446 IN A 66.232.119.xxx [HVC-AS - HIVELOCITY VENTURES CORP]ns2.world-wr.com.  81189 IN A 209.88.199.xxx [vpdn-dsl209-88-199-xxx.alami.net]Now, we observe four new IP addresses and one IP address that we saw in the first query. This demonstrates the round-robin address response mechanism used in fast-flux networks. As we have seen in this example, the A records for the domain are constantly changing. Each one of these systems represents a compromised host acting as a redirector, a redirector that eventually points to the money mule botnethttp://null.co.in
  • 33. Some more fast-flux exampleslogin.mylspacee.com. 177 IN A 66.229.133.xxx [c-66-229-133-xxx.hsd1.fl.comcast.net]login.mylspacee.com. 177 IN A 67.10.117.xxx [cpe-67-10-117-xxx.gt.res.rr.com]login.mylspacee.com. 177 IN A 70.244.2.xxx [adsl-70-244-2-xxx.dsl.hrlntx.swbell.net]login.mylspacee.com. 177 IN A 74.67.113.xxx [cpe-74-67-113-xxx.stny.res.rr.com]login.mylspacee.com. 177 IN A 74.137.49.xxx [74-137-49-xxx.dhcp.insightbb.com] mylspacee.com. 108877 IN NS ns3.myheroisyourslove.hk.mylspacee.com. 108877 IN NS ns4.myheroisyourslove.hk.mylspacee.com. 108877 IN NS ns5.myheroisyourslove.hk.mylspacee.com. 108877 IN NS ns1.myheroisyourslove.hk.mylspacee.com. 108877 IN NS ns2.myheroisyourslove.hk.ns1.myheroisyourslove.hk.854 IN A 70.227.218.xxx [ppp-70-227-218-xxx.dsl.sfldmi.ameritech.net]ns2.myheroisyourslove.hk.854 IN A 70.136.16.xxx [adsl-70-136-16-xxx.dsl.bumttx.sbcglobal.net]ns3.myheroisyourslove.hk. 854 IN A 68.59.76.xxx [c-68-59-76-xxx.hsd1.al.comcast.net]ns4.myheroisyourslove.hk. 854 IN A 70.126.19.xxx [xxx-19.126-70.tampabay.res.rr.com]ns5.myheroisyourslove.hk. 854 IN A 70.121.157.xxx [xxx.157.121.70.cfl.res.rr.com]http://null.co.in
  • 34. Results…login.mylspacee.com. 161 IN A 74.131.218.xxx [74-131-218-xxx.dhcp.insightbb.com] NEWlogin.mylspacee.com. 161 IN A 24.174.195.xxx [cpe-24-174-195-xxx.elp.res.rr.com] NEWlogin.mylspacee.com. 161 IN A 65.65.182.xxx [adsl-65-65-182-xxx.dsl.hstntx.swbell.net] NEWlogin.mylspacee.com. 161 IN A 69.215.174.xxx [ppp-69-215-174-xxx.dsl.ipltin.ameritech.net] NEWlogin.mylspacee.com. 161 IN A 71.135.180.xxx [adsl-71-135-180-xxx.dsl.pltn13.pacbell.net] NEW mylspacee.com. 108642 IN NS ns3.myheroisyourslove.hk.mylspacee.com. 108642 IN NS ns4.myheroisyourslove.hk.mylspacee.com. 108642 IN NS ns5.myheroisyourslove.hk.mylspacee.com. 108642 IN NS ns1.myheroisyourslove.hk.mylspacee.com. 108642 IN NS ns2.myheroisyourslove.hk.ns1.myheroisyourslove.hk. 608 IN A 70.227.218.xxx [ppp-70-227-218-xxx.dsl.sfldmi.ameritech.net]ns2.myheroisyourslove.hk. 608 IN A 70.136.16.xxx [adsl-70-136-16-xxx.dsl.bumttx.sbcglobal.net]ns3.myheroisyourslove.hk. 608 IN A 68.59.76.xxx [c-68-59-76-xxx.hsd1.al.comcast.net]ns4.myheroisyourslove.hk. 608 IN A 70.126.19.xxx [xxx-19.126-70.tampabay.res.rr.com]ns5.myheroisyourslove.hk. 608 IN A 70.121.157.xxx [xxx.157.121.70.cfl.res.rr.com]http://null.co.in
  • 35. ConclusionOn the basis of DNS instances by the k means clustering it is possible to detect the fast flux characteristics of botnets.New botnet detection system based on Horizontal correlation Independent of botnet C&C protocol and structureReal-world evaluation shows promising resultsThe false positive is very low in case of large IP address instances corresponding to same DNS which actually resembles with the condition of real world botnets.http://null.co.in
  • 36. AcknowledgementsNullcon team.To all the ListenersOur professors Dr. PonnurangamKumaraguruDr. ShishirNagarajahttp://null.co.in