From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware
- M. Antonakakis, R. Perdisci, D. Dagon
- Computer ScienceUSENIX Security Symposium
- 8 August 2012
A new technique to detect randomly generated domains without reversing is presented, finding that most of the DGA-generated domains that a bot queries would result in Non-Existent Domain (NXDomain) responses, and that bots from the same bot-net (with the same DGA algorithm) would generate similar NXDomain traffic.
Building a Dynamic Reputation System for DNS
- M. Antonakakis, R. Perdisci, D. Dagon, Wenke Lee, N. Feamster
- Computer ScienceUSENIX Security Symposium
- 11 August 2010
Notos, a dynamic reputation system for DNS, is proposed that malicious, agile use of DNS has unique characteristics and can be distinguished from legitimate, professionally provisioned DNS services.
Peer-to-Peer Botnets: Overview and Case Study
- J. Grizzard, Vikram Sharma, C. Nunnery, Brent Byunghoon Kang, D. Dagon
- Computer ScienceConference on Workshop on Hot Topics in…
- 10 April 2007
An overview of peer-to-peer botnets is presented and a case study of a Kademlia-based Trojan is presented, which shows how attackers will move to more resilient architectures in the near future.
Detecting Malware Domains at the Upper DNS Hierarchy
- M. Antonakakis, R. Perdisci, Wenke Lee, N. Vasiloglou, D. Dagon
- Computer ScienceUSENIX Security Symposium
- 8 August 2011
Kopis passively monitors DNS traffic at the upper levels of the DNS hierarchy, and is able to accurately detect malware domains by analyzing global DNS query resolution patterns.
PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware
- P. Royal, Mitch Halpin, D. Dagon, R. Edmonds, Wenke Lee
- Computer ScienceAsia-Pacific Computer Systems Architecture…
- 11 December 2006
The results from the experiments show the approach can be used to significantly reduce the time required to analyze such malware, and to improve the performance of malware detection tools.
A Taxonomy of Botnet Structures
- D. Dagon, G. Gu, Christopher P. Lee, Wenke Lee
- Computer ScienceAsia-Pacific Computer Systems Architecture…
- 1 December 2007
We propose a taxonomy of botnet structures, based on their utility to the botmaster. We propose key metrics to measure their utility for various activities (e.g., spam, ddos). Using these performance…
Modeling Botnet Propagation Using Time Zones
A diurnal propagation model is created that uses diurnal shaping functions to capture regional variations in online vulnerable populations and lets one compare propagation rates for different botnets, and prioritize response.
Measuring intrusion detection capability: an information-theoretic approach
- G. Gu, Prahlad Fogla, D. Dagon, Wenke Lee, B. Škorić
- Computer ScienceACM Asia Conference on Computer and…
- 21 March 2006
This paper provides a novel information-theoretic analysis of IDS and proposes a new metric, CI D (Intrusion Detection Capability), which is defined as the ratio of the mutual information between the IDS input and output to the entropy of the input.
Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS Traces
- R. Perdisci, I. Corona, D. Dagon, Wenke Lee
- Computer ScienceAsia-Pacific Computer Systems Architecture…
- 7 December 2009
A novel, passive approach based on passive analysis of recursive DNS traffic traces collected from multiple large networks able to detect malicious flux service networks in-the-wild, i.e., as they are accessed by users who fall victims of malicious content advertised through blog spam, instant messaging spam, social website spam, etc., beside email spam.
Misleading worm signature generators using deliberate noise injection
- R. Perdisci, D. Dagon, Wenke Lee, Prahlad Fogla, Monirul I. Sharif
- Computer ScienceIEEE Symposium on Security and Privacy
- 21 May 2006
A new and general class of attacks whereby a worm can combine polymorphism and misleading behavior to intentionally pollute the dataset of suspicious flows during its propagation and successfully mislead the automatic signature generation process is described.
...
...