{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,1,12]],"date-time":"2024-01-12T21:47:21Z","timestamp":1705096041960},"reference-count":6,"publisher":"World Scientific Pub Co Pte Lt","issue":"02","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Int. J. Soft. Eng. Knowl. Eng."],"published-print":{"date-parts":[[2018,2]]},"abstract":"<jats:p> Domain-Flux malware is hard to detect because of the variable C&amp;C (Command and Control) domains which were randomly generated by the technique of domain generation algorithm (DGA). In this paper, we propose a Domain-Flux malware detection approach based on DNS failure traffic. The approach fully leverages the behavior of DNS failure traffic to recognize nine features, and then mines the DGA-generated domains by a clustering algorithm and determinable rules. Theoretical analysis and experimental results verify its efficiency with both test dataset and real-world dataset. On the test dataset, our approach can achieve a true positive rate of 99.82% at false positive rate of 0.39%. On the real-world dataset, the approach can also achieve a relatively high precision of 98.3% and find out 197,026 DGA domains by analyzing DNS traffic in campus network for seven days. We found 1213 hosts of Domain-Flux malware existing on campus network, including the known Conficker, Fosniw and several new Domain-Flux malwares that have never been reported before. We classified 197,026 DGA domains and gave the representative generated patterns for a better understanding of the Domain-Flux mechanism. <\/jats:p>","DOI":"10.1142\/s0218194018400016","type":"journal-article","created":{"date-parts":[[2018,3,8]],"date-time":"2018-03-08T02:17:10Z","timestamp":1520475430000},"page":"151-173","source":"Crossref","is-referenced-by-count":3,"title":["Detecting Domain-Flux Malware Using DNS Failure Traffic"],"prefix":"10.1142","volume":"28","author":[{"given":"Futai","family":"Zou","sequence":"first","affiliation":[{"name":"School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Linsen","family":"Li","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yue","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jianhua","family":"Li","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Siyu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Network and Information Center, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kaida","family":"Jiang","sequence":"additional","affiliation":[{"name":"Network and Information Center, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"219","published-online":{"date-parts":[[2018,3,7]]},"reference":[{"key":"S0218194018400016BIB012","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2012.2184552"},{"key":"S0218194018400016BIB017","doi-asserted-by":"publisher","DOI":"10.1002\/spe.885"},{"key":"S0218194018400016BIB022","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511809071"},{"key":"S0218194018400016BIB026","doi-asserted-by":"publisher","DOI":"10.1093\/bioinformatics\/bti141"},{"key":"S0218194018400016BIB031","volume-title":"Data Mining Concepts and Techniques","author":"Han J.","year":"2001"},{"key":"S0218194018400016BIB032","volume-title":"Artificial Intelligence: A Modern Approach","author":"Russell S. J.","year":"2003"}],"container-title":["International Journal of Software Engineering and Knowledge Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.worldscientific.com\/doi\/pdf\/10.1142\/S0218194018400016","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,8,6]],"date-time":"2019-08-06T22:55:02Z","timestamp":1565132102000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.worldscientific.com\/doi\/abs\/10.1142\/S0218194018400016"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,2]]},"references-count":6,"journal-issue":{"issue":"02","published-online":{"date-parts":[[2018,3,7]]},"published-print":{"date-parts":[[2018,2]]}},"alternative-id":["10.1142\/S0218194018400016"],"URL":"https:\/\/doi.org\/10.1142\/s0218194018400016","relation":{},"ISSN":["0218-1940","1793-6403"],"issn-type":[{"value":"0218-1940","type":"print"},{"value":"1793-6403","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,2]]}}}