PsyBoG: A scalable botnet detection method for large-scale DNS traffic
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Kwon, Jonghoon | - |
dc.contributor.author | Lee, Jehyun | - |
dc.contributor.author | Lee, Heejo | - |
dc.contributor.author | Perrig, Adrian | - |
dc.date.accessioned | 2021-09-04T01:44:18Z | - |
dc.date.available | 2021-09-04T01:44:18Z | - |
dc.date.created | 2021-06-17 | - |
dc.date.issued | 2016-03-14 | - |
dc.identifier.issn | 1389-1286 | - |
dc.identifier.uri | https://scholar.korea.ac.kr/handle/2021.sw.korea/89217 | - |
dc.description.abstract | Domain Name System (DNS) traffic has become a rich source of information from a security perspective. However, the volume of DNS traffic has been skyrocketing, such that security analyzers experience difficulties in collecting, retrieving, and analyzing the DNS traffic in response to modern Internet threats. More precisely, much of the research relating to DNS has been negatively affected by the dramatic increase in the number of queries and domains. This phenomenon has necessitated a scalable approach, which is not dependent on the volume of DNS traffic. In this paper, we introduce a fast and scalable approach, called PsyBoG, for detecting malicious behavior within large volumes of DNS traffic. PsyBoG leverages a signal processing technique, power spectral density (PSD) analysis, to discover the major frequencies resulting from the periodic DNS queries of botnets. The PSD analysis allows us to detect sophisticated botnets regardless of their evasive techniques, sporadic behavior, and even normal users' traffic. Furthermore, our method allows us to deal with large-scale DNS data by only utilizing the timing information of query generation regardless of the number of queries and domains. Finally, PsyBoG discovers groups of hosts which show similar patterns of malicious behavior. PsyBoG was evaluated by conducting experiments with two different data sets, namely DNS traces generated by real maiware in controlled environments and a large number of real-world DNS traces collected from a recursive DNS server, an authoritative DNS server, and Top-Level Domain (TLD) servers. We utilized the maiware traces as the ground truth, and, as a result, PsyBoG performed with a detection accuracy of 95%. By using a large number of DNS traces, we were able to demonstrate the scalability and effectiveness of PsyBoG in terms of practical usage. Finally, PsyBoG detected 23 unknown and 26 known botnet groups with 0.1% false positives. (C) 2016 Elsevier B.V. All rights reserved. | - |
dc.language | English | - |
dc.language.iso | en | - |
dc.publisher | ELSEVIER SCIENCE BV | - |
dc.subject | TIME-SERIES | - |
dc.title | PsyBoG: A scalable botnet detection method for large-scale DNS traffic | - |
dc.type | Article | - |
dc.contributor.affiliatedAuthor | Lee, Heejo | - |
dc.identifier.doi | 10.1016/j.comnet.2015.12.008 | - |
dc.identifier.scopusid | 2-s2.0-84956980525 | - |
dc.identifier.wosid | 000371938400003 | - |
dc.identifier.bibliographicCitation | COMPUTER NETWORKS, v.97, pp.48 - 73 | - |
dc.relation.isPartOf | COMPUTER NETWORKS | - |
dc.citation.title | COMPUTER NETWORKS | - |
dc.citation.volume | 97 | - |
dc.citation.startPage | 48 | - |
dc.citation.endPage | 73 | - |
dc.type.rims | ART | - |
dc.type.docType | Article | - |
dc.description.journalClass | 1 | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalResearchArea | Engineering | - |
dc.relation.journalResearchArea | Telecommunications | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Hardware & Architecture | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Information Systems | - |
dc.relation.journalWebOfScienceCategory | Engineering, Electrical & Electronic | - |
dc.relation.journalWebOfScienceCategory | Telecommunications | - |
dc.subject.keywordPlus | TIME-SERIES | - |
dc.subject.keywordAuthor | Network security | - |
dc.subject.keywordAuthor | Botnet detection | - |
dc.subject.keywordAuthor | DNS analysis | - |
dc.subject.keywordAuthor | Power spectral density | - |
dc.subject.keywordAuthor | Group activity | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
(02841) 서울특별시 성북구 안암로 14502-3290-1114
COPYRIGHT © 2021 Korea University. All Rights Reserved.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.