A Methodology for Multipurpose DNS Sinkhole Analyzing Double Bounce Emails

摘要: DNS sinkhole is one of the powerful techniques to mitigate attack activities bots, i.e., zombie PCs, by blocking communication between C&C server and them. If a PC sends query our for communicating with its server, that contains domain blacklist servers returns IP address server. As result, since tries communicate it unable On other hand, there are many cyber attacks caused malicious URLs included in spam emails. Therefore, if we extract from emails apply them into system, based can be blocked. In this paper, propose methodology enhance capability system analyzing Especially, use double bounce emails, which do not have any valid sender recipient addresses, as Our preliminary experimental results demonstrate existing effective. Thus, design new method collecting show how generated. With using blacklist, will able early detect block latest behaviors on Internet.