Detect Fast-Flux Domains Through Response Time Differences

• Published in: IEEE journal on selected areas in communications Vol. 32; no. 10; pp. 1947 - 1956
• Main Authors: Hsu, Fu-Hau, Wang, Chuan-Sheng, Hsu, Chi-Hsien, Tso, Chang-Kuo, Chen, Li-Han, Lin, Song-Hui
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.10.2014; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Equations; Internet appliances; IP networks; Mathematical model; Measurement; Servers; Time factors; Training; Security; invasive software; network-level security and protection

A fast-flux service network (FFSN) uses dynamic DNS to map a dynamic domain, called fast-flux domain (FF domain), to various IP addresses and uses flux bots to redirect network traffic. Due to its powerful capability to conceal the hosts hidden behind the flux bots, FFSNs are widely adopted by attac...