Malicious automatically generated domain name detection using Stateful-SBB

Authors:
Fariba Haddadi;H. Gunes Kayacik;A. Nur Zincir-Heywood;Malcolm I. Heywood
Affiliations:
Computer Science, Dalhousie University, Halifax, NS, Canada;Glasgow Caledonian University, Scotland, UK;Computer Science, Dalhousie University, Halifax, NS, Canada;Computer Science, Dalhousie University, Halifax, NS, Canada
Venue:
EvoApplications'13 Proceedings of the 16th European conference on Applications of Evolutionary Computation
Year:
2013

Citing 9
Cited 0

Introduction to Machine Learning (Adaptive Computation and Machine Learning)

Introduction to Machine Learning (Adaptive Computation and Machine Learning)
A Survey of Botnet Technology and Defenses

CATCH '09 Proceedings of the 2009 Cybersecurity Applications & Technology Conference for Homeland Security
Beyond blacklists: learning to detect malicious web sites from suspicious URLs

Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining
A Survey of Botnet and Botnet Detection

SECURWARE '09 Proceedings of the 2009 Third International Conference on Emerging Security Information, Systems and Technologies
Symbiosis, complexification and simplicity under GP

Proceedings of the 12th annual conference on Genetic and evolutionary computation
Building a dynamic reputation system for DNS

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
A Survey on Latest Botnet Attack and Defense

TRUSTCOM '11 Proceedings of the 2011IEEE 10th International Conference on Trust, Security and Privacy in Computing and Communications
Symbiotic coevolutionary genetic programming: a benchmarking study under large attribute spaces

Genetic Programming and Evolvable Machines
Detecting algorithmically generated domain-flux attacks with DNS traffic analysis

IEEE/ACM Transactions on Networking (TON)

Quantified Score

Hi-index	0.00

Visualization

Abstract

This work investigates the detection of Botnet Command and Control (C&C) activity by monitoring Domain Name System (DNS) traffic. Detection signatures are automatically generated using evolutionary computation technique based on Stateful-SBB. The evaluation performed shows that the proposed system can work on raw variable length domain name strings with very high accuracy.