Not So Fast Flux Networks for Concealing Scam Servers

James D. Cannady; Theodore O. Cochran

doi:10.1109/CRISIS.2010.5764914

Not So Fast Flux Networks for Concealing Scam Servers

James D. Cannady
, Theodore O. Cochran

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

This work investigates the use of Fast Flux Service Networks as an element of the host infrastructure for illegal scam transaction servers referenced in spam email. The goal of the research is to better understand the dynamics, distinguishing features, and potential vulnerabilities of these networks in order to blacklist, block, or otherwise mitigate their effectiveness. This approach consists of active DNS and HTTP interrogation techniques for feature extraction. Results show that these proxy networks are both prevalent and discernible from legitimate high availability web sites. Monitoring of their DNS behavior over time reveals patterns and anomalies that may be exploitable.

Original language	American English
Title of host publication	Proceedings of the Fifth International Conference on Risks and Security of Internet Systems
DOIs	https://doi.org/10.1109/CRISIS.2010.5764914
State	Published - Oct 1 2010
Event	Fifth International Conference on Risks and Security of Internet Systems - Duration: Oct 1 2010 → …

Conference

Conference	Fifth International Conference on Risks and Security of Internet Systems
Period	10/1/10 → …

Disciplines

Computer Sciences

Access to Document

10.1109/CRISIS.2010.5764914License: CC BY

Cite this

@inproceedings{95bd76dfcf9f4cfca7dca4d2ff01a252,

title = "Not So Fast Flux Networks for Concealing Scam Servers",

abstract = " This work investigates the use of Fast Flux Service Networks as an element of the host infrastructure for illegal scam transaction servers referenced in spam email. The goal of the research is to better understand the dynamics, distinguishing features, and potential vulnerabilities of these networks in order to blacklist, block, or otherwise mitigate their effectiveness. This approach consists of active DNS and HTTP interrogation techniques for feature extraction. Results show that these proxy networks are both prevalent and discernible from legitimate high availability web sites. Monitoring of their DNS behavior over time reveals patterns and anomalies that may be exploitable.",

author = "Cannady, \{James D.\} and Cochran, \{Theodore O.\}",

year = "2010",

month = oct,

day = "1",

doi = "10.1109/CRISIS.2010.5764914",

language = "American English",

booktitle = "Proceedings of the Fifth International Conference on Risks and Security of Internet Systems",

note = "Fifth International Conference on Risks and Security of Internet Systems ; Conference date: 01-10-2010",

}

TY - GEN

T1 - Not So Fast Flux Networks for Concealing Scam Servers

AU - Cannady, James D.

AU - Cochran, Theodore O.

PY - 2010/10/1

Y1 - 2010/10/1

N2 - This work investigates the use of Fast Flux Service Networks as an element of the host infrastructure for illegal scam transaction servers referenced in spam email. The goal of the research is to better understand the dynamics, distinguishing features, and potential vulnerabilities of these networks in order to blacklist, block, or otherwise mitigate their effectiveness. This approach consists of active DNS and HTTP interrogation techniques for feature extraction. Results show that these proxy networks are both prevalent and discernible from legitimate high availability web sites. Monitoring of their DNS behavior over time reveals patterns and anomalies that may be exploitable.

AB - This work investigates the use of Fast Flux Service Networks as an element of the host infrastructure for illegal scam transaction servers referenced in spam email. The goal of the research is to better understand the dynamics, distinguishing features, and potential vulnerabilities of these networks in order to blacklist, block, or otherwise mitigate their effectiveness. This approach consists of active DNS and HTTP interrogation techniques for feature extraction. Results show that these proxy networks are both prevalent and discernible from legitimate high availability web sites. Monitoring of their DNS behavior over time reveals patterns and anomalies that may be exploitable.

UR - https://nsuworks.nova.edu/gscis_facarticles/451

U2 - 10.1109/CRISIS.2010.5764914

DO - 10.1109/CRISIS.2010.5764914

M3 - Conference contribution

BT - Proceedings of the Fifth International Conference on Risks and Security of Internet Systems

T2 - Fifth International Conference on Risks and Security of Internet Systems

Y2 - 1 October 2010

ER -

Not So Fast Flux Networks for Concealing Scam Servers

Abstract

Conference

Disciplines

Access to Document

Other files and links

Fingerprint

Cite this