An Improvement for Fast-Flux Service Networks Detection Based on Data Mining Techniques推荐.pdfVIP

An Improvement for Fast-Flux Service Networks Detection Based on Data Mining Techniques 1 1 2 1 Ziniu Chen , Jian Wang , Yujian Zhou , and Chunping Li 1 Data Mining Group, School of Software, Tsinghua University, Beijing, China czn09@ wj-217@163.com cli@ 2 MOST Information Center, Beijing, China zhouyujian@ Abstract. Fast-flux is a kind of DNS technique used by botnets to hide the actual location of malicious servers. It is considered as an emerging threat for information security. In this paper, we propose an approach to detect the fast-flux service network (FFSN) using data mining tech- niques. Furthermore, we use the resampling technique to solve imbal- anced classification problem with respect to FFSNs detection. Experi- ment results in the real datasets show that our approach improves the detective precision and effectiveness compared with existing researches. 1 Introduction Botnets have been created to perform a wide range of illegal activities [1]. An emerging new use of botnets by cyber-criminals is a technique called Fast-Flux Service Networks (FFSNs). FFSNs are used in many illegal practices, including online pharmacy shops, money mule recruitment sites, phishing websites, illegal adult content, malicious browser exploit websites and the distribution of malware downloads, etc [2][5]. Generally speaking, FFSNs refer to rapidly changing the mapping between IP address and domain name. Each victim’s request to visit the web server will thus reach one of the bots, and the