Detecting Botnet Activities Based on Abnormal DNS traffic

Details Detecting Botnet Activities Based on Abnormal DNS traffic Detecting Botnet Activities Based on Abnormal DNS traffic

2009-11-03

arxiv.org/abs/0911.0487v1

International Journal of Computer Science and Information Security, IJCSIS, Vol. 6, No. 1, pp. 097-104, October 2009, USA

Computer Science

Networking and Internet Architecture

8 pages IEEE format, International Journal of Computer Science and Information Security, IJCSIS 2009, ISSN 1947 5500, Impact F

Scientific paper

IThe botnet is considered as a critical issue of the Internet due to its fast growing mechanism and affect. Recently, Botnets have utilized the DNS and query DNS server just like any legitimate hosts. In this case, it is difficult to distinguish between the legitimate DNS traffic and illegitimate DNS traffic. It is important to build a suitable solution for botnet detection in the DNS traffic and consequently protect the network from the malicious Botnets activities. In this paper, a simple mechanism is proposed to monitors the DNS traffic and detects the abnormal DNS traffic issued by the botnet based on the fact that botnets appear as a group of hosts periodically. The proposed mechanism is also able to classify the DNS traffic requested by group of hosts (group behavior) and single hosts (individual behavior), consequently detect the abnormal domain name issued by the malicious Botnets. Finally, the experimental results proved that the proposed mechanism is robust and able to classify DNS traffic, and efficiently detects the botnet activity with average detection rate of 89 percent.

Affiliated with

Also associated with

No associations

Rating

Detecting Botnet Activities Based on Abnormal DNS traffic does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.

If you have personal experience with Detecting Botnet Activities Based on Abnormal DNS traffic, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Detecting Botnet Activities Based on Abnormal DNS traffic will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFWR-SCP-O-256193