HUSCAP logo Hokkaido Univ. logo

Hokkaido University Collection of Scholarly and Academic Papers >
Information Initiative Center >
Peer-reviewed Journal Articles, etc >

Design and implementation of NS record history database for detecting DNS-based botnet communication

Files in This Item:
IA2017-31.pdf337.65 kBPDFView/Open
Please use this identifier to cite or link to this item:http://hdl.handle.net/2115/86953

Title: Design and implementation of NS record history database for detecting DNS-based botnet communication
Authors: Ichise, Hikaru Browse this author
Jin, Yong Browse this author →KAKEN DB
Iida, Katsuyoshi Browse this author →KAKEN DB
Keywords: Botnet communication
DNS
NS record history
database
Issue Date: 8-Nov-2017
Publisher: 電子情報通信学会
Journal Title: 電子情報通信学会技術研究報告
Journal Title(alt): IEICE Technical Report
Volume: 117
Issue: 299
Start Page: 7
End Page: 11
Abstract: DNS (Domain Name System) based domain name resolution service is one of the most fundamental Internet services for the Internet users and application service providers. In normal DNS based domain name resolution, the corresponding NS records are required in prior to sending DNS query to the corresponding authoritative DNS servers. However, in recent years, DNS based botnet communication has been observed in which botnet related network traffic is transferred via DNS packets. In particular, sending DNS queries to C&C servers using IP address directly without obtaining the corresponding NS records is present in some malware. In this paper, we focus on this type of botnet communication and design a NS record history database for detecting DNS-based botnet communication. We implemented a prototype system and evaluated the feature of NS records history creation as well as the checking function. Based on the evaluation results we confirmed the proposed database worked as we designed and it is expected to detect the target botnet communication.
Publisher URI: https://ken.ieice.org/ken/paper/20171115XbZn/
Type: article
URI: http://hdl.handle.net/2115/86953
Appears in Collections:情報基盤センター (Information Initiative Center) > 雑誌発表論文等 (Peer-reviewed Journal Articles, etc)

Submitter: 飯田 勝吉

Export metadata:

OAI-PMH ( junii2 , jpcoar_1.0 )

MathJax is now OFF:


 

 - Hokkaido University