Other formats:
BibTeX
LaTeX
RIS
@inproceedings{1313947,
author = {Ghafir, Ibrahim and Přenosil, Václav},
address = {Noida, India},
booktitle = {Proceedings of International Conference on Signal Processing and Integrated networks},
doi = {http://dx.doi.org/10.1109/SPIN.2015.7095337},
keywords = {Cyber attacks; botnet; malicious domain; malware; intrusion detection system},
howpublished = {tištěná verze "print"},
language = {eng},
location = {Noida, India},
isbn = {978-1-4799-5991-4},
pages = {613-618},
publisher = {IEEE Xplore Digital Library},
title = {DNS Traffic Analysis for Malicious Domains Detection},
url = {http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7095337&newsearch=true&searchWithin=%22First%20Name%22:Ibrahim&searchWithin=%22Last%20Name%22:Ghafir},
year = {2015}
}
TY - JOUR
ID - 1313947
AU - Ghafir, Ibrahim - Přenosil, Václav
PY - 2015
TI - DNS Traffic Analysis for Malicious Domains Detection
PB - IEEE Xplore Digital Library
CY - Noida, India
SN - 9781479959914
KW - Cyber attacks
KW - botnet
KW - malicious domain
KW - malware
KW - intrusion detection system
UR - http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7095337&newsearch=true&searchWithin=%22First%20Name%22:Ibrahim&searchWithin=%22Last%20Name%22:Ghafir
L2 - http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7095337&newsearch=true&searchWithin=%22First%20Name%22:Ibrahim&searchWithin=%22Last%20Name%22:Ghafir
N2 - The web has become the medium of choice for people to search for information, conduct business, and enjoy entertainment. At the same time, the web has also become the primary platform used by miscreants to attack users. For example, drive-by-download attacks, which could be through malicious domains, are a popular choice among bot herders to grow their botnets. In this paper we present our methodology for detecting any connection to malicious domain. Our detection method is based on a blacklist of malicious domains. We process the network traffic, particularly DNS traffic. We analyze all DNS requests and match the query with the blacklist. The blacklist of malicious domains is updated automatically and the detection is in the real time. We applied our methodology on a packet capture (pcap) file which contains traffic to malicious domains and we proved that our methodology can successfully detect the connections to malicious domains. We also applied our methodology on campus live traffic and showed that it can detect malicious domain connections in the real time.
ER -
GHAFIR, Ibrahim and Václav PŘENOSIL. DNS Traffic Analysis for Malicious Domains Detection. In \textit{Proceedings of International Conference on Signal Processing and Integrated networks}. Noida, India: IEEE Xplore Digital Library, 2015, p.~613-618. ISBN~978-1-4799-5991-4. Available from: https://dx.doi.org/10.1109/SPIN.2015.7095337.
|
