title: Fast Flux Watch: A mechanism for online detection of fast flux networks.
abstract: Fast flux networks represent a special type of botnets that are used to provide highly available web services to a backend server, which usually hosts malicious content. Detection of fast flux networks continues to be a challenging issue because of the similar behavior between these networks and other legitimate infrastructures, such as CDNs and server farms. This paper proposes Fast Flux Watch (FF-Watch), a mechanism for online detection of fast flux agents. FF-Watch is envisioned to exist as a software agent at leaf routers that connect stub networks to the Internet. The core mechanism of FF-Watch is based on the inherent feature of fast flux networks: flux agents within stub networks take the role of relaying client requests to point-of-sale websites of spam campaigns. The main idea of FF-Watch is to correlate incoming TCP connection requests to flux agents within a stub network with outgoing TCP connection requests from the same agents to the point-of-sale website. Theoretical and traffic trace driven analysis shows that the proposed mechanism can be utilized to efficiently detect fast flux agents within a stub network.
authors: CyberSecurity Research Laboratory, Department of Network Engineering and Security, Jordan University of Science and Technology, Irbid 22110, Jordan.
authors: Basheer N
authors: BN
authors: Al-Duwairi
authors: CyberSecurity Research Laboratory, Department of Network Engineering and Security, Jordan University of Science and Technology, Irbid 22110, Jordan.
authors: Ahmad T
authors: AT
authors: Al-Hammouri
keywords: Bloom filter; Botnets; Correlated TCP SYN; Fast flux networks; Network security