PROJECT TITLE :
Early Detection of Malicious Flux Networks via Large-Scale Passive DNS Traffic Analysis
During this paper, we gift FluxBuster, a unique passive DNS traffic analysis system for detecting and tracking malicious flux networks. FluxBuster applies giant-scale monitoring of DNS traffic traces generated by recursive DNS (RDNS) servers located in tons of various networks scattered across several different geographical locations. Unlike most previous work, our detection approach is not restricted to the analysis of suspicious domain names extracted from spam emails or precompiled domain blacklists. Instead, FluxBuster is ready to detect malicious flux service networks in-the-wild, i.e., as they are "accessed” by users who fall victim of malicious content, independently of how this malicious content was advertised. We tend to performed a protracted-term evaluation of our system spanning a period of concerning five months. The experimental results show that FluxBuster is able to accurately detect malicious flux networks with a low false positive rate. Furthermore, we show that in many cases FluxBuster is in a position to detect malicious flux domains several days or even weeks before they seem in public domain blacklists.
Did you like this research project?
To get this research project Guidelines, Training and Code... Click Here