| Presentation | 2017-11-15 Design and implementation of NS record history database for detecting DNS-based botnet communication Hikaru Ichise, Yong Jin, Katsuyoshi Iida, |
|---|---|
| PDF Download Page |  PDF download Page Link |
| Abstract(in Japanese) | (See Japanese page) |
| Abstract(in English) | DNS (Domain Name System) based domain name resolution service is one of the most fundamental Internet services for the Internet users and application service providers. In normal DNS based domain name resolution, the corresponding NS records are required in prior to sending DNS query to the corresponding authoritative DNS servers. However, in recent years, DNS based botnet communication has been observed in which botnet related network traffic is transferred via DNS packets. In particular, sending DNS queries to C&C servers using IP address directly without obtaining the corresponding NS records is present in some malware. In this paper, we focus on this type of botnet communication and design a NS record history database for detecting DNS-based botnet communication. We implemented a prototype system and evaluated the feature of NS records history creation as well as the checking function. Based on the evaluation results we confirmed the proposed database worked as we designed and it is expected to detect the target botnet communication. |
| Keyword(in Japanese) | (See Japanese page) |
| Keyword(in English) | Botnet communicationDNSNS record historydatabase |
| Paper # | IA2017-31 |
| Date of Issue | 2017-11-08 (IA) |
| Conference Information | |
| Committee | IA |
|---|---|
| Conference Date | 2017/11/15(2days) |
| Place (in Japanese) | (See Japanese page) |
| Place (in English) | KMITL, Bangkok, Thailand |
| Topics (in Japanese) | (See Japanese page) |
| Topics (in English) | IA2017 - Workshop on Internet Architecture and Applications 2017 |
| Chair | Katsuyoshi Iida(Hokkaido Univ.) |
| Vice Chair | Rei Atarashi(IIJ) / Hiroyuki Osaki(Kwansei Gakuin Univ.) / Tomoki Yoshihisa(Osaka Univ.) |
| Secretary | Rei Atarashi(Tokyo Metropolitan Univ.) / Hiroyuki Osaki(TOYOTA-IT) / Tomoki Yoshihisa |
| Assistant | Kenji Ohira(Tokushima Univ.) / Ryohei Banno(NTT) / Toshiki Watanabe(NEC) |
| Paper Information | |
| Registration To | Technical Committee on Internet Architecture |
|---|---|
| Language | ENG |
| Title (in Japanese) | (See Japanese page) |
| Sub Title (in Japanese) | (See Japanese page) |
| Title (in English) | Design and implementation of NS record history database for detecting DNS-based botnet communication |
| Sub Title (in English) | |
| Keyword(1) | Botnet communicationDNSNS record historydatabase |
| 1st Author's Name | Hikaru Ichise |
| 1st Author's Affiliation | Tokyo Institute of Technology/Hokkaido University(Tokyo Tech./Hokkaido Univ.) |
| 2nd Author's Name | Yong Jin |
| 2nd Author's Affiliation | Tokyo Institute of Technology(Tokyo Tech.) |
| 3rd Author's Name | Katsuyoshi Iida |
| 3rd Author's Affiliation | Hokkaido University(Tokyo Tech./Hokkaido Univ.) |
| Date | 2017-11-15 |
| Paper # | IA2017-31 |
| Volume (vol) | vol.117 |
| Number (no) | IA-299 |
| Page | pp.pp.7-11(IA), |
| #Pages | 5 |
| Date of Issue | 2017-11-08 (IA) |