Not So Fast Flux Networks for Concealing Scam Servers
Montreal, Canada / 2010
In Proceedings of the Fifth International Conference on Risks and Security of Internet Systems
ISSN or ISBN
This work investigates the use of Fast Flux Service Networks as an element of the host infrastructure for illegal scam transaction servers referenced in spam email. The goal of the research is to better understand the dynamics, distinguishing features, and potential vulnerabilities of these networks in order to blacklist, block, or otherwise mitigate their effectiveness. This approach consists of active DNS and HTTP interrogation techniques for feature extraction. Results show that these proxy networks are both prevalent and discernible from legitimate high availability web sites. Monitoring of their DNS behavior over time reveals patterns and anomalies that may be exploitable.
Cannady, James D. Jr. and Cochran, Theodore O., "Not So Fast Flux Networks for Concealing Scam Servers" (2010). CEC Faculty Articles. 451.