Design and implementation of NS record history database for detecting DNS-based botnet communication

Ichise, Hikaru; Jin, Yong; Iida, Katsuyoshi

電子情報通信学会技術研究報告, 2017, 117(299), 7-11

Permalink : https://hdl.handle.net/2115/86953

このアイテムのアクセス数:315件（2026-08-12 15:05 集計）

閲覧可能ファイル 

ファイル フォーマット サイズ 閲覧回数 説明
IA2017-31 pdf 337 KB 232

論文情報

ファイル出力 EndNote Basic出力 Mendeley出力

アクセス権
open access
URI
https://hdl.handle.net/2115/86953
タイトル
Design and implementation of NS record history database for detecting DNS-based botnet communication
著者
Ichise, Hikaru ; Jin, Yong ; Iida, Katsuyoshi
著者名
Ichise, Hikaru
e-Rad_Researcher
60725787
著者名
Jin, Yong
e-Rad_Researcher
00332768
著者名
Iida, Katsuyoshi
言語
英語
キーワード
Botnet communication
DNS
NS record history
database
発行日
2017-11-08
出版者
電子情報通信学会
収録物名
電子情報通信学会技術研究報告
IEICE Technical Report
巻(号)
117(299)
ページ
7-11
抄録
DNS (Domain Name System) based domain name resolution service is one of the most fundamental Internet services for the Internet users and application service providers. In normal DNS based domain name resolution, the corresponding NS records are required in prior to sending DNS query to the corresponding authoritative DNS servers. However, in recent years, DNS based botnet communication has been observed in which botnet related network traffic is transferred via DNS packets. In particular, sending DNS queries to C&C servers using IP address directly without obtaining the corresponding NS records is present in some malware. In this paper, we focus on this type of botnet communication and design a NS record history database for detecting DNS-based botnet communication. We implemented a prototype system and evaluated the feature of NS records history creation as well as the checking function. Based on the evaluation results we confirmed the proposed database worked as we designed and it is expected to detect the target botnet communication.
資源タイプ
学術雑誌論文
出版タイプ
Version of Record
PISSN
0913-5685
EISSN
2432-6380
関連情報 (isIdenticalTo)
URI
https://ken.ieice.org/ken/paper/20171115XbZn/