On botnets that use DNS for command and control

Christian J. Dietrich; Christian Rossow; Felix C. Freiling; Herbert Bos; Maarten Van Steen; Norbert Pohlmann

doi:10.1109/EC2ND.2011.16

On botnets that use DNS for command and control

Christian J. Dietrich^*
, Christian Rossow
, Felix C. Freiling
, Herbert Bos
, Maarten Van Steen
, Norbert Pohlmann

^*Corresponding author for this work

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

Abstract

We discovered and reverse engineered Feederbot, a botnet that uses DNS as carrier for its command and control. Using k-Means clustering and a Euclidean Distance based classifier, we correctly classified more than 14m DNS transactions of 42,143 malware samples concerning DNS-C&C usage, revealing another bot family with DNS C&C. In addition, we correctly detected DNS C&C in mixed office workstation network traffic.

Original language	English
Title of host publication	2011 7th European Conference on Computer Network Defense, EC2ND 2011 (Proceedings)
Publisher	IEEE
Pages	9-16
Number of pages	8
ISBN (Print)	9780769547626
DOIs	https://doi.org/10.1109/EC2ND.2011.16
Publication status	Published - 13 Dec 2012
Event	2011 7th European Conference on Computer Network Defense, EC2ND 2011 - Gothenburg, Sweden Duration: 6 Sept 2011 → 7 Sept 2011

Conference

Conference	2011 7th European Conference on Computer Network Defense, EC2ND 2011
Country/Territory	Sweden
City	Gothenburg
Period	6/09/11 → 7/09/11

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 3 Good Health and Well-being

Keywords

botnet detection
command and control
dns
malware detection

Access to Document

10.1109/EC2ND.2011.16

Persistent URL (handle)

Persistent link

Cite this

@inproceedings{8af48664593b46f6b655e7daef9de8be,

title = "On botnets that use DNS for command and control",

abstract = "We discovered and reverse engineered Feederbot, a botnet that uses DNS as carrier for its command and control. Using k-Means clustering and a Euclidean Distance based classifier, we correctly classified more than 14m DNS transactions of 42,143 malware samples concerning DNS-C\&C usage, revealing another bot family with DNS C\&C. In addition, we correctly detected DNS C\&C in mixed office workstation network traffic.",

keywords = "botnet detection, command and control, dns, malware detection",

author = "Dietrich, \{Christian J.\} and Christian Rossow and Freiling, \{Felix C.\} and Herbert Bos and Steen, \{Maarten Van\} and Norbert Pohlmann",

year = "2012",

month = dec,

day = "13",

doi = "10.1109/EC2ND.2011.16",

language = "English",

isbn = "9780769547626",

pages = "9--16",

booktitle = "2011 7th European Conference on Computer Network Defense, EC2ND 2011 (Proceedings)",

publisher = "IEEE",

note = "2011 7th European Conference on Computer Network Defense, EC2ND 2011 ; Conference date: 06-09-2011 Through 07-09-2011",

}

Dietrich, CJ, Rossow, C, Freiling, FC, Bos, H, Steen, MV & Pohlmann, N 2012, On botnets that use DNS for command and control. in 2011 7th European Conference on Computer Network Defense, EC2ND 2011 (Proceedings)., 6377756, IEEE, pp. 9-16, 2011 7th European Conference on Computer Network Defense, EC2ND 2011, Gothenburg, Sweden, 6/09/11. https://doi.org/10.1109/EC2ND.2011.16

TY - GEN

T1 - On botnets that use DNS for command and control

AU - Dietrich, Christian J.

AU - Rossow, Christian

AU - Freiling, Felix C.

AU - Bos, Herbert

AU - Steen, Maarten Van

AU - Pohlmann, Norbert

PY - 2012/12/13

Y1 - 2012/12/13

N2 - We discovered and reverse engineered Feederbot, a botnet that uses DNS as carrier for its command and control. Using k-Means clustering and a Euclidean Distance based classifier, we correctly classified more than 14m DNS transactions of 42,143 malware samples concerning DNS-C&C usage, revealing another bot family with DNS C&C. In addition, we correctly detected DNS C&C in mixed office workstation network traffic.

AB - We discovered and reverse engineered Feederbot, a botnet that uses DNS as carrier for its command and control. Using k-Means clustering and a Euclidean Distance based classifier, we correctly classified more than 14m DNS transactions of 42,143 malware samples concerning DNS-C&C usage, revealing another bot family with DNS C&C. In addition, we correctly detected DNS C&C in mixed office workstation network traffic.

KW - botnet detection

KW - command and control

KW - dns

KW - malware detection

UR - https://www.scopus.com/pages/publications/84872228595

UR - https://www.scopus.com/pages/publications/84872228595#tab=citedBy

U2 - 10.1109/EC2ND.2011.16

DO - 10.1109/EC2ND.2011.16

M3 - Conference contribution

SN - 9780769547626

SP - 9

EP - 16

BT - 2011 7th European Conference on Computer Network Defense, EC2ND 2011 (Proceedings)

PB - IEEE

T2 - 2011 7th European Conference on Computer Network Defense, EC2ND 2011

Y2 - 6 September 2011 through 7 September 2011

ER -

On botnets that use DNS for command and control

Abstract

Conference

UN SDGs

Keywords

Access to Document

Persistent URL (handle)

Other files and links

Fingerprint

Cite this