Towards active measurement for DNS query behavior of botnets

摘要: Domain names play an increasingly important role for the botnet activities. Traditionally, DNS traces from several local servers are used passively to measure query behavior. However, since botnets a wide-scale threat and usually reside in geographically dispersed networks, vantage point of is sometimes too small help us understand behavior (e.g., whether queried or not, average rate) botnets. In this paper, we actively networks via cache probing technique. We first analytically characterize how multiple domain by different under certain circumstances. Then, real samples wild gain insight into 480 globally, show that our analytical characterization well describes samples. The active measurement technique can acquire extensive information thus potentially facilitate various DNS-related research applications.