Detection of Fast-Flux Domains Based on Passive DNS Analysis

doi:10.13209/j.0479-8023.2016.064

Acta Scientiarum Naturalium Universitatis Pekinensis ›› 2016, Vol. 52 ›› Issue (3): 396-402.DOI: 10.13209/j.0479-8023.2016.064

Previous Articles Next Articles

Detection of Fast-Flux Domains Based on Passive DNS Analysis

ZHOU Changling^1,2,3, CHEN Kai^1,2, GONG Xuxiao¹, CHEN Ping¹, MA Hao¹

1. Computer Center of Peking University, Beijing 100871
2. School of Electronics Engineering and Computer Science, Peking University, Beijing 100871
3. Institute of Computer Science & Technology of Peking University, Beijing 100871

Received:2015-06-01 Revised:2015-07-07 Online:2016-05-20 Published:2016-05-20
Contact: ZHOU Changling, E-mail: zclfly(at)pku.edu.cn

基于Passive DNS的速变域名检测

周昌令^1,2,3, 陈恺^1,2, 公绪晓¹, 陈萍¹, 马皓¹

1. 北京大学计算中心, 北京 100871
2. 北京大学信息科学技术学院, 北京 100871
3. 北京大学计算机研究所, 北京 100871

通讯作者: 周昌令, E-mail: zclfly(at)pku.edu.cn
基金资助:
国家2012 年下一代互联网技术研发、产业化和规模商用专项项目(CNGI-12-03-001)、国家发展改革委员会2011 年国家信息安全专项和863 计划(2015AA011403)资助

Abstract

Abstract:

The authors use Passive DNS to log domain name query history of real campus network environment, and construct eighteen feature sets grouping by diversity, time, growth, and relevance, and then propose a model detect Fast-Flux Domains using random forest algorithm. The result shows that the proposed model can classify domains with accuracy over 90% by cross validation experiments. The model can detect Fast-Flux domains in the datasets used in this study more effectively compared with Fluxbuster.

Key words: Passive DNS, fast-flux domain, random forest algorithm, DGA, CDN

摘要：

利用Passive DNS采集校园网真实运行环境的域名访问记录, 从域名的多样性、时间性、增长性和相关性等方面构建18个特征集, 提出基于随机森林算法来识别速变域名的模型。交叉验证实验表明, 所构建的模型对域名分类的准确率超过90%。在所采集的数据集上, 所构建的模型比FluxBuster 能更有效地识别速变域名。

关键词: Passive DNS, 速变域名, 随机森林算法, DGA, CDN

CLC Number:

TP393

ZHOU Changling, CHEN Kai, GONG Xuxiao, CHEN Ping, MA Hao. Detection of Fast-Flux Domains Based on Passive DNS Analysis[J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2016, 52(3): 396-402.

周昌令, 陈恺, 公绪晓, 陈萍, 马皓. 基于Passive DNS的速变域名检测[J]. 北京大学学报（自然科学版）, 2016, 52(3): 396-402.

Add to citation manager EndNote|Ris|BibTeX

URL: https://xbna.pku.edu.cn/EN/10.13209/j.0479-8023.2016.064

https://xbna.pku.edu.cn/EN/Y2016/V52/I3/396

[1]	ZHOU Jianing, ZHANG Jie, LI Tianhong. Bashang Forest Change Monitoring with Multi-Temporal MODIS Images and Random Forest Algorithm [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2018, 54(4): 792-800.
[2]	CHEN Jianghua,NI Xuewen,MO Bangxian. A High-Order Temperature Compensated CMOS Bandgap Reference [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2008, 44(4): 517-521.
[3]	GUO Lei,CHENG Yinghao,WANG Ziyi,HE Bin,ZHANG Junjun,LIU Shiqing,LIU Meihua,CHEN Zhangliang,QU Lijia,GU Hongya. Primary Study on Gene Expression during Root Differentiation from Rice Calli [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2006, 42(2): 175-179.
[4]	SUN Jun,LIN Jiaojiao,CHENG Guofeng,LI Hao,SHI Yaojun,LU Ke,CAI Youmin,JIANG Hongbo. Gene Difference Expression Between Mice and Microtus fortis Infected with Schistosoma japonicum Using cDNA Microarrays [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2004, 40(4): 532-537.
[5]	XIE Hailong,ZHOU Xiaojun. Primary Study on Metastasis-Related Genes of Gastric Carcinoma Using cDNA Microarray [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2004, 40(4): 505-512.
[6]	YU Ruiyuan,SUN Jiurong,MU Xiaodong,WANG Yanfeng. GAP-43 mRNA Levels Change of the Hippocampus in Rat after Impact Traumatic Brain Injury [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2003, 39(6): 799-803.
[7]	ZHOU Jianjun,QU Hong,WU Caihong,HAN Weidong,LI Zhiwei,FENG Meifu. cDNA Cloning, Sequence Analysis, Expression and Protein Structure Modeling of HLA-G1 from Chinese [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2002, 38(2): 212-220.
[8]	KANG Qiaohua,JI Qingzhou,RU Binggen . Cloning of Rab3a cDNA from Human Fetal Placenta [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2002, 38(2): 271-275.
[9]	DONG Yuqing,LI Ronggui,ZHAO Jindong,WU Guangyao. Cloning and Expression of the Rabbit Growth Hormone cDNA [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 2000, 36(2): 199-202.
[10]	MA Suyong,ZHOU Xianwan,ZHANG Tingfang. Studies on Purification and Properties of Glutathione S-transferase from Asian corn Borer [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 1999, 35(4): 474-479.
[11]	ZHAO Li,DUAN Xueyan,WANG Chunxia,WU Xiangyu. Cloning, Sequencing of Pea cop1 cDNA and Its Expression in E.coli [J]. Acta Scientiarum Naturalium Universitatis Pekinensis, 1999, 35(4): 453-458.

Detection of Fast-Flux Domains Based on Passive DNS Analysis

基于Passive DNS的速变域名检测

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 11

Recommended Articles

Metrics