Fast flux service networks detection model

Abstract

Fast flux service networks (FFSNs) architecture employ DNS approach to establish a multi layer network on compromised machines to host their illegal online services. This architecture enables frequent change of IP addresses and name servers which frustrate the trace back and web taken down from the authorities. On internal network, the FFSNs can be detected via analysis on DNS data traffic monitoring. The DNS resource records can be passively collected by replicating the logged queries and requests on the collectors. These data can be use as a significant feature for detecting FFSN by filtering and classifying them. The potential candidate domain grouped for clustering by tagging with the similarity of their behaviour. The proposed detection mechanism can be integrated with other monitoring and detection tools for further increase and tighten up the network security.