비정상도메인 분류를 위한 DNS 쿼리 기반의 주성분 분석을 이용한 성분추출
Feature Selection with PCA based on DNS Query for Malicious Domain Classification
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
최근 봇넷(Botnet)은 탐지 기술을 피하기 위하여 C&C(Command and Control)서버 접속시 DNS(Domain Name System) 서비스를 이용하고있다. DNS 서비스를 이용한 비정상 행위에 대응하기 위해서 DNS 트래픽 기반의 분석 연구가 필요하다. 본 논문에서는 좀비PC의 C&C서버 도메인주소 질의와 같은 DNS트래픽 기반의 비정상 도메인 분류(Classification)를 위해서 DNS트래픽 수집 및 지도학습(Supervised Learning)에대해 연구한다. 특히, 본 논문에서는 PCA(Principal Component Analysis) 주성분분석 기술을 통해 DNS 기반의 분류시스템에서의 효과적인 분석 성분들을 구성할 수 있다.
Abstract
Recent botnets are widely using the DNS services at the connection of C&C server in order to evade botnet’s detection. It is necessary to study on DNS analysis in order to counteract anomaly-based technique using the DNS. This paper studies collection of DNS traffic for experimental data and supervised learning for DNS traffic-based malicious domain classification such as query of domain name corresponding to C&C server from zombies. Especially, this paper would aim to determine significant features of DNS-based classification system for malicious domain extraction by the Principal Component Analysis(PCA).
참고문헌 (11)
- H. Choi, "Botnet detection by monitoring group activities in DNS traffic Computer and Information Technology 2007", 7th IEEE International Conference on, 2007, pp.715~720 (2007)
- G. Gu, "BotSniffer: Detecting botnet command and control channels in network traffic", Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS’08) (2008)
- G. Gu, "BotMiner: clustering analysis of network traffic for protocol-and structureindependent botnet detection", Proceedings of the 17th conference on Security symposium, pp.139~154 (2008)
- J. Liu, "Botnet: Classification, attacks, detection, tracing, and preventive measures", EURASIP journal on wireless communications and networking, 2009, pp.1184~1187 (2009)
- R. Villamarín-Salomón, "Identifying botnets using anomaly detection techniques applied to DNS traffic", Consumer Communications and Networking Conference, pp.476~481 (2008)
- J. Dietrich, "On Botnets that use DNS for Command and Control", ~
- R. Villamarín-Salomón, "Bayesian bot detection based on DNS traffic similarity", Proceedings of the 2009 ACM symposium on Applied Computing, pp.2035~2041 (2009)
- H. Tu, "Detecting botnets by analyzing DNS traffic", Intelligence and Security Informatics, pp.323~324 (2007)
- Jiawei Han, "Data Mining 2nd Edition" (2007)
- L. Bilge, "EXPOSURE: Finding malicious domains using passive dns analysis", Proceedings of the Annual Network and Distributed System Security (NDSS) (2011)