Detecting Infected Botnet Machines by the Use of DNS Server Traffic Analysis

Detection of machines infected with botnets through domain name system (DNS) traffic analysis is a means of confronting a new generation of cyber-attacks. One of today’s security challenges is activity in domain name systems. Botnets are among these new generation of threats. Botnets are centered on DNS and they infect victim computers using Trojans or e-mails to which malicious codes are attached. As a result, botnets cede control of the victim computer to a botmaster to carry out targeted attacks. In this paper, the author studied interactions of botnets with DNS systems and the requests and responses exchanged with DNS systems. The authors also proposed a detection mechanism based on the behavioral pattern of a botnet. The results of this research revealed new anomalies and led to an anomaly detection method.

Keywords:

Domain Name System , botnet , botmaster , command and control (C&C)