Name
Abstract | ||
|---|---|---|
Malware families utilize different protocols to establish their covert communication networks. It is also the case that sometimes they utilize protocols which are least expected to be used for transferring data, e.g., Domain Name System (DNS). Even though the DNS protocol is designed to be a translation service between domain names and IP addresses, it leaves some open doors to establish covert channels in DNS, which is widely known as DNS tunneling. In this paper, we characterize the malicious payload distribution channels in DNS. Our proposed solution characterizes these channels based on the DNS query and response messages patterns. We performed an extensive analysis of malware datasets for one year. Our experiments indicate that our system can successfully determine different patterns of the DNS traffic of malware families. |
Year | DOI | Venue |
|---|---|---|
2014 | 10.1109/NTMS.2014.6814008 | NTMS |
Keywords | Field | DocType |
cryptographic protocols,invasive software,DNS protocol,DNS traffic,DNS tunneling,IP addresses,communication networks,covert channel characterization,domain name system,malicious payload distribution channels,malware datasets,malware families,message patterns,translation service | Computer science,Domain Name System,DNS hijacking,Covert channel,Round-robin DNS,Computer network,Communication channel,DNS zone transfer,Malware,Payload,Distributed computing | Conference |
ISSN | Citations | PageRank |
2157-4952 | 3 | 0.40 |
References | Authors | |
12 | 4 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Hamad Binsalleeh | 1 | 170 | 9.48 |
| Kara, A.M. | 2 | 3 | 0.40 |
| Amr Youssef | 3 | 238 | 29.69 |
| Mourad Debbabi | 4 | 1467 | 144.47 |