Detecting Malicious Fast Flux Domains
Mahmoud T. Qassrawi, Hong Li Zhang · Applied Mechanics and Materials · 2012
Fast-flux service networks (FFSN) are new emerging phenomenon in the internet. Fast-flux networks use proxy networks of compromised machines to redirect and host scam service to achieve high availability. Such technique helps scam websites to avoid being traced and taken down by security professionals. In this paper, we use alternative decision tree algorithm to identify presence of fast-flux domains by analyzing only one address record (A-record) of DNS lookup, which achieves fast detection.