RB-Seeker: Auto-detection of Redirection Botnets.

摘要: A Redirection Botnet (RBnet) is a vast collection of compromised computers (called bots) used as redirection/proxy infrastructure and under the control botmaster. We present design, implementation evaluation system called Seeker (RB-Seeker) for automatic detection RBnets by utilizing three cooperating subsystems. Two subsystems are to generate database domains participating in redirection: one detects redirection bots following links embedded spam emails, other behavior based on network traces at large university edge router using sequential hypothesis testing. The generated these two fed into final subsystem, which then performs DNS query probing over time. Based certain behavioral attributes extracted from queries, subsystem makes use 2-tier strategy hyperplane decision functions. This allows it quickly identify aggressive with low false-positive rate (< 0.008%), while also accurately detecting stealthy (i.e., those mimicking valid behavior, such CDNs) monitoring their Using means RBnets, RB-Seeker impervious botmaster’s choice Command-and-Control (C&C) channel how botmaster communicates controls or encryption.