Quickly Identifying FFSN Domain and CDN Domain with Little Dataset
Youshuai Zhao, Zhengping Jin · 2015
Fast-flux net has been adopted by more and more attackers to build up bot-net, which consists of many proxy-hosts that are changing fast.With this technology, tracing and locating the C&C (control and command) host is more complex and difficult, so that how to identify whether a domain belongs to a FFSN(fast flux service net) or not is still a very challenging problem.One of these important reasons is that FFSN domains are similar to legitimate CDN(content delivery net) domains.This paper proposes a new method that uses a little dataset got by active probing, to quickly identify legitimate CDN domains and malicious FFSN domains.Aiming at quickly and effectively identifying domains with little dataset, our proposal is mainly based on FFSN domains' intrinsic characteristics,which are summarized through studying previous researches and data analysis, including features shown in the process of DNS analysis and the process of HTTP visiting.Finally, we use the CART(classification and regression tree) algorithm to train and predict dataset.And the result manifests that the proposed mechanism can be utilized to classify FFSN domains and CDN domains in a few days, which is far less than months taken by previous works, and at a quite high accuracy 90% approximately.