Not So Fast Flux Networks for Concealing Scam Servers

Author(s)

James D. Cannady Jr., Nova Southeastern UniversityFollow
Theodore O. Cochran, Nova Southeastern UniversityFollow

Document Type

Article

Publication Title

In Proceedings of the Fifth International Conference on Risks and Security of Internet Systems

Event Date/Location

Montreal, Canada / 2010

ISSN

2151-4763

Publication Date

10-2010

Abstract

This work investigates the use of Fast Flux Service Networks as an element of the host infrastructure for illegal scam transaction servers referenced in spam email. The goal of the research is to better understand the dynamics, distinguishing features, and potential vulnerabilities of these networks in order to blacklist, block, or otherwise mitigate their effectiveness. This approach consists of active DNS and HTTP interrogation techniques for feature extraction. Results show that these proxy networks are both prevalent and discernible from legitimate high availability web sites. Monitoring of their DNS behavior over time reveals patterns and anomalies that may be exploitable.

DOI

10.1109/CRISIS.2010.5764914

NSUWorks Citation

Cannady, James D. Jr. and Cochran, Theodore O., "Not So Fast Flux Networks for Concealing Scam Servers" (2010). CCE Faculty Articles. 451.
https://nsuworks.nova.edu/gscis_facarticles/451