基于IP分布及请求响应时间的恶意fast-flux域名检测算法

Malicious Fast-Flux Domains Detection Algorithm Based on IP Distribution and Request Response Time

提出了一种基于域名对应IP分布及IP对请求响应时间波动的恶意fast-flux域名检测算法。该算法基于合法域名与fast-flux僵尸网络域名在域名解析IP的分布特性与IP对请求响应时间波动特性方面的差异,将解析IP分布特性与IP对请求响应时间的波动性作为参量生成两维特征,给出具体的特征表示。通过SVM分类器进行实验验证了该两维特征的分类效果。特征分析及实验结果表明,相比于现有的检测方法,文章算法能够更准确地检测恶意fastflux域名,虚警率、漏报率较低。

A malicious fast-flux domains detection algorithm is proposed based on IP distribution corresponding to a domain and fluctuation of request response time by IPs.Based on differences in IP distribution and fluctuation of request response time of legitimate domains and malicious fast-flux domains,the proposed algorithm uses IP distribution and fluctuation of request response time as parameters,generates two features and gives concrete representations of them; and this paper conducts the experiment with SVM classifier and validates the classifying effect.Features analysis and experimental result show that compared to the existing algorithms,the algorithm proposed by this paper can detect malicious fast-flux domains more accurately,and both false alarm rate and rate of missing report are very low.