DNS Based Spam Bots Detection in a University
Dennis Arturo Ludeña Romaña, Shinichiro Kubota, Kenichi Sugitani, Yasuo Musashi · International journal of intelligent engineering and systems · 2009
We carried out an entropy study on the DNS query traffic from the outside of a university campus network to the top domain DNS server when querying about reverse resolution on the PC room terminals through April 1st, 2007 to April 30th, 2008.The following interesting results are given: (1) The total DNS query traffic changes in a mild manner until January 16th, 2008, however it drastically changes after January 17th, 2008.(2) In January 17th, 2008, the DNS query traffic is mainly dominated by several specific IP addresses as their query keywords.(3) We carried out forensic analysis on the PC room terminals in which IP addresses are found in the several specific keywords and it is concluded that the PCs become spam bots when inserting USB based key disk storage.