Presentation 2017-11-15
Design and implementation of NS record history database for detecting DNS-based botnet communication
Hikaru Ichise, Yong Jin, Katsuyoshi Iida,
PDF Download Page PDF download Page Link
Abstract(in Japanese) (See Japanese page)
Abstract(in English) DNS (Domain Name System) based domain name resolution service is one of the most fundamental Internet services for the Internet users and application service providers. In normal DNS based domain name resolution, the corresponding NS records are required in prior to sending DNS query to the corresponding authoritative DNS servers. However, in recent years, DNS based botnet communication has been observed in which botnet related network traffic is transferred via DNS packets. In particular, sending DNS queries to C&C servers using IP address directly without obtaining the corresponding NS records is present in some malware. In this paper, we focus on this type of botnet communication and design a NS record history database for detecting DNS-based botnet communication. We implemented a prototype system and evaluated the feature of NS records history creation as well as the checking function. Based on the evaluation results we confirmed the proposed database worked as we designed and it is expected to detect the target botnet communication.
Keyword(in Japanese) (See Japanese page)
Keyword(in English) Botnet communicationDNSNS record historydatabase
Paper # IA2017-31
Date of Issue 2017-11-08 (IA)

Conference Information
Committee IA
Conference Date 2017/11/15(2days)
Place (in Japanese) (See Japanese page)
Place (in English) KMITL, Bangkok, Thailand
Topics (in Japanese) (See Japanese page)
Topics (in English) IA2017 - Workshop on Internet Architecture and Applications 2017
Chair Katsuyoshi Iida(Hokkaido Univ.)
Vice Chair Rei Atarashi(IIJ) / Hiroyuki Osaki(Kwansei Gakuin Univ.) / Tomoki Yoshihisa(Osaka Univ.)
Secretary Rei Atarashi(Tokyo Metropolitan Univ.) / Hiroyuki Osaki(TOYOTA-IT) / Tomoki Yoshihisa
Assistant Kenji Ohira(Tokushima Univ.) / Ryohei Banno(NTT) / Toshiki Watanabe(NEC)

Paper Information
Registration To Technical Committee on Internet Architecture
Language ENG
Title (in Japanese) (See Japanese page)
Sub Title (in Japanese) (See Japanese page)
Title (in English) Design and implementation of NS record history database for detecting DNS-based botnet communication
Sub Title (in English)
Keyword(1) Botnet communicationDNSNS record historydatabase
1st Author's Name Hikaru Ichise
1st Author's Affiliation Tokyo Institute of Technology/Hokkaido University(Tokyo Tech./Hokkaido Univ.)
2nd Author's Name Yong Jin
2nd Author's Affiliation Tokyo Institute of Technology(Tokyo Tech.)
3rd Author's Name Katsuyoshi Iida
3rd Author's Affiliation Hokkaido University(Tokyo Tech./Hokkaido Univ.)
Date 2017-11-15
Paper # IA2017-31
Volume (vol) vol.117
Number (no) IA-299
Page pp.pp.7-11(IA),
#Pages 5
Date of Issue 2017-11-08 (IA)