Quantitatively Analyzing Stealthy Communication Channels

10 years 11 months ago
Quantitatively Analyzing Stealthy Communication Channels
Abstract. Attackers in particular botnet controllers use stealthy messaging systems to set up large-scale command and control. Understanding the capacity of such communication channels is important in detecting organized cyber crimes. We analyze the use of domain name service (DNS) as a stealthy botnet command-and-control channel, which allows multiple entities to pass messages stored in DNS records to each other. We describe and quantitatively analyze new techniques that can be used to hide malicious DNS activities both at the host and network levels. We also present and experimentally evaluate statistical content-analysis techniques as a countermeasure, which require deep packet inspection. Our techniques are beyond the specific DNS security problem studied. We give a formal definition for the perfect stealth of a communication channel; point out the fundamental limits in achieving it, as well as the practical issues in the detection. We perform comprehensive statistical analysis t...
Patrick Butler, Kui Xu, Danfeng (Daphne) Yao
Added 24 Aug 2011
Updated 24 Aug 2011
Type Journal
Year 2011
Where ACNS
Authors Patrick Butler, Kui Xu, Danfeng (Daphne) Yao
Comments (0)