FluXOR: Detecting and Monitoring Fast-flux Service Networks Emanuele - - PowerPoint PPT Presentation

▶
fluxor detecting and monitoring fast flux service networks
SMART_READER_LITE
LIVE PREVIEW

FluXOR: Detecting and Monitoring Fast-flux Service Networks Emanuele - - PowerPoint PPT Presentation

Oct 28, 2022 385 likes •742 views

Universit` a degli Studi di Milano Facolt` a di Scienze Matematiche, Fisiche e Naturali Dipartimento di Informatica e Comunicazione FluXOR: Detecting and Monitoring Fast-flux Service Networks Emanuele Passerini , Roberto Paleari, Lorenzo

slide-1
SLIDE 1

Universit` a degli Studi di Milano Facolt` a di Scienze Matematiche, Fisiche e Naturali Dipartimento di Informatica e Comunicazione

FluXOR: Detecting and Monitoring Fast-flux Service Networks

Emanuele Passerini, Roberto Paleari, Lorenzo Martignoni, Danilo Bruschi

DIMVA 2008

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 1 / 12

slide-2
SLIDE 2

Botnets

What is a botnet?

a network of infected machines (bots) used simultaneously to achieve the same purpose different purposes: spam, DDoS, phishing, scam, massive SQL injection, . . .

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 2 / 12

slide-3
SLIDE 3

Botnets

What is a botnet?

a network of infected machines (bots) used simultaneously to achieve the same purpose different purposes: spam, DDoS, phishing, scam, massive SQL injection, . . .

Fast-flux service networks

a new (∼ 2007) technique to maximize botnets availability simple idea: add an additional indirection layer (i.e., proxy) between victims and controlling elements

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 2 / 12

slide-4
SLIDE 4

Fast-flux botnets

Architecture

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-5
SLIDE 5

Fast-flux botnets

Architecture Victim Non-authoritative name server

A? tje.mooffx.com.cn

Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Authoritative name server (ns1.ktthe.com) Mother-ship (tje.mooffx.com.cn)

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-6
SLIDE 6

Fast-flux botnets

Architecture Victim Non-authoritative name server

A? tje.mooffx.com.cn

Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Authoritative name server (ns1.ktthe.com)

+ A? tje.mooffx.com.cn

Mother-ship (tje.mooffx.com.cn)

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-7
SLIDE 7

Fast-flux botnets

Architecture Victim Non-authoritative name server

A? tje.mooffx.com.cn

Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Agent2 Agent3 Agent1 Authoritative name server (ns1.ktthe.com)

+ A? tje.mooffx.com.cn A 212.23.46.91 A 137.243.0.8 ...

Mother-ship (tje.mooffx.com.cn)

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-8
SLIDE 8

Fast-flux botnets

Architecture Victim Non-authoritative name server

A? tje.mooffx.com.cn A 137.243.0.8 A ...

Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Agent2 Agent3 Agent1 Authoritative name server (ns1.ktthe.com)

+ A? tje.mooffx.com.cn A 212.23.46.91 A 137.243.0.8 ...

Mother-ship (tje.mooffx.com.cn)

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-9
SLIDE 9

Fast-flux botnets

Architecture Victim Non-authoritative name server

A? tje.mooffx.com.cn A 137.243.0.8 A ...

Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Agent2 Agent3 Agent1

G E T / i n d . . .

Authoritative name server (ns1.ktthe.com)

+ A? tje.mooffx.com.cn A 212.23.46.91 A 137.243.0.8 ...

Mother-ship (tje.mooffx.com.cn)

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-10
SLIDE 10

Fast-flux botnets

Architecture Victim Non-authoritative name server

A? tje.mooffx.com.cn A 137.243.0.8 A ...

Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Agent2 Agent3 Agent1

G E T / i n d . . .

Authoritative name server (ns1.ktthe.com)

+ A? tje.mooffx.com.cn A 212.23.46.91 A 137.243.0.8 ...

Mother-ship (tje.mooffx.com.cn)

G E T / i n d . . .

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-11
SLIDE 11

Fast-flux botnets

Architecture Victim Non-authoritative name server

A? tje.mooffx.com.cn A 137.243.0.8 A ...

Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Agent2 Agent3 Agent1

G E T / i n d . . .

Authoritative name server (ns1.ktthe.com)

+ A? tje.mooffx.com.cn A 212.23.46.91 A 137.243.0.8 ...

Mother-ship (tje.mooffx.com.cn)

G E T / i n d . . . M a l w a r e

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-12
SLIDE 12

Fast-flux botnets

Architecture Victim Non-authoritative name server

A? tje.mooffx.com.cn A 137.243.0.8 A ...

Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Agent2 Agent3 Agent1

G E T / i n d . . . Malware

Authoritative name server (ns1.ktthe.com)

+ A? tje.mooffx.com.cn A 212.23.46.91 A 137.243.0.8 ...

Mother-ship (tje.mooffx.com.cn)

G E T / i n d . . . M a l w a r e

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 3 / 12

slide-13
SLIDE 13

Fast-flux botnets

Characteristics

Victim Non-authoritative name server Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Authoritative name server Mother-ship

  • ff-line, disinfected, and faulty bots (or agents) are

immediately replaced by others Warezov/Storm networks have millions of agents! Storm: ∼ 1 billion spam messages during a six-weeks attack

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 4 / 12

slide-14
SLIDE 14

Fast-flux botnets

Characteristics

Victim Non-authoritative name server Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Authoritative name server Mother-ship

identity of the core components of the architecture (e.g., mothership) is hidden to the victims

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 4 / 12

slide-15
SLIDE 15

Fast-flux botnets

Characteristics

Victim Non-authoritative name server Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Authoritative name server Mother-ship

multiple FQDNs can be associated with the same fast-flux service network it is not enough to close malicious FQDN!

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 4 / 12

slide-16
SLIDE 16

Fast-flux botnets

Characteristics

Victim Non-authoritative name server Agent2 Agent3 Agent5 Agent4 Agent1 Agent6 Authoritative name server Mother-ship

Real impact

The average lifetime of the scam site becomes months instead of days! The only way shut down scam site is to clean all agents

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 4 / 12

slide-17
SLIDE 17

Our contribution

Observation

a fast-flux service network has multiple distinguishing features taken singularly are not enough to distinguish between benign and malicious hostnames

Idea: FluXOR

monitor the suspicious hostname for a small period of time to collect distinguishing features, behaving like a recidivious victim combine features to distinguish between benign and malicious domains monitor malicious domains to enumerate all infected agents

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 5 / 12

slide-18
SLIDE 18

Features of fast-flux service networks

Domain

Domain age Domain registrar

Availability of the network

# of DNS records of type “A” TTL of DNS resource records

Heterogeneity of the agents

# of networks # of autonomous systems # of resolved QDNs # of assigned network names # of organisations

Benign avast.com 539 adriaticobishkek.com 65 google.com 542 mean 493.27

  • std. dev.

289.27 Malicious eveningher.com 18 factvillage.com 2 doacasino.com 2 mean 4.85

  • std. dev.

4.9

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 6 / 12

slide-19
SLIDE 19

Features of fast-flux service networks

Domain

Domain age Domain registrar

Availability of the network

# of DNS records of type “A” TTL of DNS resource records

Heterogeneity of the agents

# of networks # of autonomous systems # of resolved QDNs # of assigned network names # of organisations

Benign avast.com NetworkSolutions adriaticobishkek.com Melbourne IT google.com MarkMonitor mean N/A

  • std. dev.

N/A Malicious eveningher.com PayCenter factvillage.com PayCenter doacasino.com NameCheap mean N/A

  • std. dev.

N/A

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 6 / 12

slide-20
SLIDE 20

Features of fast-flux service networks

Domain

Domain age Domain registrar

Availability of the network

# of DNS records of type “A” TTL of DNS resource records

Heterogeneity of the agents

# of networks # of autonomous systems # of resolved QDNs # of assigned network names # of organisations

Benign avast.com 12 adriaticobishkek.com 21 google.com 3 mean 2.86

  • std. dev.

3.89 Malicious eveningher.com 127 factvillage.com 117 doacasino.com 33 mean 98.13

  • std. dev.

37.27

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 6 / 12

slide-21
SLIDE 21

Features of fast-flux service networks

Domain

Domain age Domain registrar

Availability of the network

# of DNS records of type “A” TTL of DNS resource records

Heterogeneity of the agents

# of networks # of autonomous systems # of resolved QDNs # of assigned network names # of organisations

Benign avast.com 3600 adriaticobishkek.com 1200 google.com 300 mean 4592.53

  • std. dev.

7668.74 Malicious eveningher.com 300 factvillage.com 300 doacasino.com 180 mean 261.49

  • std. dev.

59.64

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 6 / 12

slide-22
SLIDE 22

Features of fast-flux service networks

Domain

Domain age Domain registrar

Availability of the network

# of DNS records of type “A” TTL of DNS resource records

Heterogeneity of the agents

# of networks # of autonomous systems # of resolved QDNs # of assigned network names # of organisations

Benign avast.com 5 adriaticobishkek.com 1 google.com 2 mean 1.27

  • std. dev.

0.65 Malicious eveningher.com 83 factvillage.com 81 doacasino.com 19 mean 63.75

  • std. dev.

23.91

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 6 / 12

slide-23
SLIDE 23

Features of fast-flux service networks

Domain

Domain age Domain registrar

Availability of the network

# of DNS records of type “A” TTL of DNS resource records

Heterogeneity of the agents

# of networks # of autonomous systems # of resolved QDNs # of assigned network names # of organisations

Benign avast.com 3 adriaticobishkek.com 1 google.com 1 mean 1.11

  • std. dev.

0.36 Malicious eveningher.com 49 factvillage.com 46 doacasino.com 14 mean 38.36

  • std. dev.

12.34

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 6 / 12

slide-24
SLIDE 24

Features of fast-flux service networks

Domain

Domain age Domain registrar

Availability of the network

# of DNS records of type “A” TTL of DNS resource records

Heterogeneity of the agents

# of networks # of autonomous systems # of resolved QDNs # of assigned network names # of organisations

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 6 / 12

slide-25
SLIDE 25

Overall architecture

Collector

harvests domain names from various sources (e.g., spam emails, DNS queries, . . . ) each collected domain name is flagged as suspicious

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 7 / 12

slide-26
SLIDE 26

Overall architecture

Monitor

for each suspicious domain name, it collects characterizing features for each malicious domain name, it enumerates the IP addresses of the agents serving the network

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 7 / 12

slide-27
SLIDE 27

Overall architecture

Detector

automatic classification of domain names as malicious or benign combine collected features using na¨ ıve Bayesian classifier training sets: 50 benign + 58 malicious domains (manually classified) — automatic cross-validation

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 7 / 12

slide-28
SLIDE 28

Implementation and deployment of the system

Implementation & deployment

∼ 2150 lines of Python code + web interface MySQL DB (3 tables, the biggest one has ∼75 millions tuples) distributed on 5 hosts (1 DB + 1 collector + 2 monitor + 1 detector)

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 8 / 12

slide-29
SLIDE 29

Experimental results

Detection accuracy

Testing strategy: manual analysis of a random subset of the active domains just 1 hour to tell if a FQDN is malicious or not

spam e-mails 989530 FQDNs 100508 benign FQDNs 56920 inactive FQDNs 35902 malicious FQDNs 27264 agents 479546

Table: Summary of the results obtained using FluXOR since January 2008.

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 9 / 12

slide-30
SLIDE 30

Experimental results

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 10 / 12

slide-31
SLIDE 31

Experimental results

We discover about 160 malicious FQDNs daily!

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 10 / 12

slide-32
SLIDE 32

Experimental results

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 10 / 12

slide-33
SLIDE 33

Experimental results

We discover more than 2200 new agents daily!

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 10 / 12

slide-34
SLIDE 34

Conclusions

Contributions

identification of the features that characterize fast-flux botnets experimental system to monitor fast-flux service networks empirical analysis of the fast-flux phenomenon

FluXOR: on-line web interface

Real-time results are publicly available on-line at: http://fluxor.laser.dico.unimi.it/

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 11 / 12

slide-35
SLIDE 35

Thanks for the attention!

Questions? http://fluxor.laser.dico.unimi.it/ The average system load is 9.78, we need a sponsor!!

  • E. Passerini, R. Paleari, L. Martignoni, D. Bruschi

FluXOR DIMVA 2008 12 / 12