Automated Fast-flux Detection using Machine Learning and Genetic Algorithms
Sachin Rana, Ahmet Aksoy · 2021
Fast-flux is a technique employed by malicious bots to hide their origin by rapidly changing DNS entries. Although specific features are known to help detect malicious hosts, attackers are becoming more knowledgeable and can spoof these values to make the infected hosts resilient to detection. This paper presents an entirely automated fast-flux detection approach using machine learning and genetic algorithms without expert input. Such an automated approach helps detect the uniqueness in malicious hosts' behavior from their network traffic even when their behavior changes. The presented approach makes fast-flux detection insusceptible to changes in infected hosts as long as a representative dataset is provided, making it more difficult for attackers to hide their hosts. Our approach was able to achieve more than 99% accuracy in classifying benign and malicious hosts.