Detection and Control of DNS based Botnet Communications by Using SDN-Ryu Solution

• Item type: SIG Technical Reports(1)
• 公開日: 2016-02-25
• タイトル: Detection and Control of DNS based Botnet Communications by Using SDN-Ryu Solution
• タイトル / 言語: en
• タイトル: Detection and Control of DNS based Botnet Communications by Using SDN-Ryu Solution
• 言語: eng
• キーワード / 主題Scheme: Other
• キーワード / 主題: SDN，OpenFlow
• 資源タイプ / 資源タイプ識別子: http://purl.org/coar/resource_type/c_18gh
• 資源タイプ: technical report
• 著者所属: Global Scientific Information and Computing Center, Tokyo Institute of Technology
• 著者所属: Global Scientific Information and Computing Center, Tokyo Institute of Technology
• 著者所属: Global Scientific Information and Computing Center, Tokyo Institute of Technology
• 著者所属(英): en
• 著者所属(英): Global Scientific Information and Computing Center, Tokyo Institute of Technology
• 著者所属(英): en
• 著者所属(英): Global Scientific Information and Computing Center, Tokyo Institute of Technology
• 著者所属(英): en
• 著者所属(英): Global Scientific Information and Computing Center, Tokyo Institute of Technology
• 著者名: Sebastian, Li; Yong, Jin; Katsuyoshi, Iida
• 著者名(英): Sebastian, Li; Yong, Jin; Katsuyoshi, Iida
• 論文抄録 / 内容記述タイプ: Other
• 論文抄録 / 内容記述: Domain Name System (DNS) is the most widely used protocol in the Internet for domain name Resolution. Since DNS provides many fundamental features Internet users would be strenuous without DNS. Recently, there are reports indicating malicious use of DNS to perform Botnet communications. However, since DNS traffic cannot be simply blocked due to its indispensability in the Internet. As such, we would like to propose a method on how to detect and control DNS based botnet communications by monitoring direct outbound DNS queries using OpenFlow Technology. We also constructed a local experimental network and evaluated the prototype system and confirmed that the proposed method worked as we expected. By using our proposed method, it is possible to detect and control some DNS based botnet based communications especially that uses direct outbound DNS traffic.
• 論文抄録(英) / 内容記述タイプ: Other
• 論文抄録(英) / 内容記述: Domain Name System (DNS) is the most widely used protocol in the Internet for domain name Resolution. Since DNS provides many fundamental features Internet users would be strenuous without DNS. Recently, there are reports indicating malicious use of DNS to perform Botnet communications. However, since DNS traffic cannot be simply blocked due to its indispensability in the Internet. As such, we would like to propose a method on how to detect and control DNS based botnet communications by monitoring direct outbound DNS queries using OpenFlow Technology. We also constructed a local experimental network and evaluated the prototype system and confirmed that the proposed method worked as we expected. By using our proposed method, it is possible to detect and control some DNS based botnet based communications especially that uses direct outbound DNS traffic.
• 書誌レコードID / 収録物識別子タイプ: NCID
• 書誌レコードID / 収録物識別子: AA12326962
• 書誌情報: 研究報告インターネットと運用技術（IOT）; 巻 2016-IOT-32, 号 12, p. 1-6, 発行日 2016-02-25
• ISSN / 収録物識別子タイプ: ISSN
• ISSN / 収録物識別子: 2188-8787
• Notice: SIG Technical Reports are nonrefereed and hence may later appear in any journals, conferences, symposia, etc.
• 出版者 / 言語: ja
• 出版者: 情報処理学会