Detecting malware based on expired command-and-control traffic. (July 2017)

• Record Type: Journal Article
• Authors: Zou, Futai; Zhang, Siyu; Li, Linsen; Pan, Li; Li, Jianhua
• Is Part Of: International journal of distributed sensor networks. Volume 13:Number 7(2017)
• Publication Date: 2017-07
• Subjects: Malware detection -- expired command-and-control -- domain name system -- time sequence analysis; Sensor networks -- Periodicals; Intelligent agents (Computer software) -- Periodicals; Multisensor data fusion -- Periodicals; 681.2
• DOI: 10.1177/1550147717720791
• Languages: English
• ISSNs: 1550-1329

Abstract

In this article, we analyze the behavioral characteristics of domain name service queries produced by programs and then design an algorithm to detect malware with expired command-and-control domains based on the key feature of domain name service traffic, that is, repeatedly querying domain with a fixed interval. In total, 3027 malware command-and-control domains in the network traffic of Shanghai Jiao Tong University, affecting 249 hosts, were successfully detected, with a high precision of 92.0%. This algorithm can find those malware with expired command-and-control domains that are usually ignored by current research and would have important value for eliminating network security risks and improving network security environment.