Tracking multiple C&C botnets by analyzing DNS traffic

Jehyun Lee, Jonghun Kwon, Hyo Jeong Shin, Heejo Lee

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    16 Citations (Scopus)


    Botnets have been considered as a main source of Internet threats. A common feature of recent botnets is the use of one or more C&C servers with multiple domain names for the purpose of increasing flexibility and survivability. In contrast with single domain botnets, these multi domain botnets are hard to be quarantined because they change domain names regularly for connecting their C&C server(s). In this paper, we introduce a tracking method of botnets by analyzing the relationship of domain names in DNS traffic generated from botnets. By examining the DNS queries from the clients which accessed the known malicious domain names, we can find a set of unknown malicious domain names and their relationship. This method enables to track malicious domain names and clients duplicately infected by multiple bot codes which make botnets revivable against existing quarantine methods. From the experiments with one hour DNS traffic in an ISP network, we find tens of botnets, and each botnet has tens of malicious domains. In addition to botnet domains, we find a set of other domain names used for spamming or advertising servers. The proposed method can be used for quarantining recent botnets and for limiting their survivability by tracking the change of domain names.

    Original languageEnglish
    Title of host publication2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010
    Number of pages6
    Publication statusPublished - 2010
    Event2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010 - Kyoto, Japan
    Duration: 2010 Oct 52010 Oct 5

    Publication series

    Name2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010


    Other2010 6th IEEE Workshop on Secure Network Protocols, NPSec 2010

    ASJC Scopus subject areas

    • Computer Networks and Communications


    Dive into the research topics of 'Tracking multiple C&C botnets by analyzing DNS traffic'. Together they form a unique fingerprint.

    Cite this