CEC Faculty Articles

Title

Not So Fast Flux Networks for Concealing Scam Servers

Event Date/Location

Montreal, Canada / 2010

Document Type

Article

Date

10-2010

Publication Title

In Proceedings of the Fifth International Conference on Risks and Security of Internet Systems

ISSN or ISBN

2151-4763

Description

This work investigates the use of Fast Flux Service Networks as an element of the host infrastructure for illegal scam transaction servers referenced in spam email. The goal of the research is to better understand the dynamics, distinguishing features, and potential vulnerabilities of these networks in order to blacklist, block, or otherwise mitigate their effectiveness. This approach consists of active DNS and HTTP interrogation techniques for feature extraction. Results show that these proxy networks are both prevalent and discernible from legitimate high availability web sites. Monitoring of their DNS behavior over time reveals patterns and anomalies that may be exploitable.

DOI

10.1109/CRISIS.2010.5764914

This document is currently not available here.

Find in your library

Share

COinS