Detection DNS Tunneling Botnets

Bohdan Savenko, Sergii Lysenko, Kira Bobrovnikova, Олег Савенко, George Markowsky

20212021 11th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS)24 citationsDOI

Abstract

Botnets are often used in cyberattacks on network services and individual users, so the ability to detect botnets is very important. Botnets use DNS tunneling to send malicious command-and-control (C&C) commands to victims' hosts. Unfortunately, DNS tunneling attacks are very hard to detect. The paper presents a new approach for DNS tunneling botnet detection, which considers all the features and architectural characteristics of botnets. The technique described in this paper is highly efficient at detecting DNS tunneling attacks.

Topics & Concepts

BotnetComputer scienceComputer securityComputer networkCommand and controlThe InternetWorld Wide WebTelecommunicationsNetwork Security and Intrusion DetectionInternet Traffic Analysis and Secure E-votingAdvanced Malware Detection Techniques