Identifying botnets by capturing group activities in DNS traffic

摘要: Botnets have become the main vehicle to conduct online crimes such as DDoS, spam, phishing and identity theft. Even though numerous efforts been directed towards detection of botnets, evolving evasion techniques easily thwart detection. Moreover, existing approaches can be overwhelmed by large amount data needed analyzed. In this paper, we propose a light-weight mechanism detect botnets using their fundamental characteristics, i.e., group activity. The proposed mechanism, referred BotGAD (botnet activity detector) needs small from DNS traffic botnet, not all network content or known signatures. large-scale in real-time even botnet performs encrypted communications. that adopt recent techniques. We evaluate multiple traces collected different sources including campus ISP networks. evaluation shows automatically while providing monitoring scale