Fast-Flux Bot Detection in Real Time

Abstract. The fast-flux service network architecture has been widely adopted by bot herders to increase the productivity and extend the lifes-pan of botnets ’ domain names. A fast-flux botnet is unique in that each of its domain names is normally mapped to different sets of IP addresses over time and legitimate users ’ requests are handled by machines other than those contacted by users directly. Most existing methods for de-tecting fast-flux botnets rely on the former property. This approach is effective, but it requires a certain period of time, maybe a few days, before a conclusion can be drawn. In this paper, we propose a novel way to detect whether a web service is hosted by a fast-flux botnet in real time. The scheme is unique because it relies on certain intrinsic and invariant characteristics of fast-flux bot-nets, namely, 1) the request delegation model, 2) bots are not dedicated to malicious services, and 3) the hardware used by bots is normally infe-rior to that of dedicated servers. Our empirical evaluation results show that, using a passive measurement approach, the proposed scheme can detect fast-flux bots in a few seconds with more than 96 % accuracy, while the false positive/negative rates are both lower than 5%

ADAPT: an anonymous, distributed, and active probing-based technique for detecting malicious fast-flux domains

The fast-fluxing has been used by attackers to increase the availability of malicious domains and the robustness against detection systems. Since 2008, researchers have proposed a number of methods to detect malicious fast-flux domains, however they have some common drawbacks in the system design, which are as follows: no anonymity, partial view on the domain, and unable to detect before an attack takes place. Therefore, to overcome these drawbacks, we propose a new technique called ADAPT, which enables a detection system to collect DNS information of a domain anonymously all around the globe in short period of time with less resource using Tor network. In this thesis, we have developed a prototype of ADAPT, which takes its input from domain zone files to detect in-the-wild malicious fast-flux domains. We defined a flux score formula to propose 10 new detection features. The prototype of ADAPT has scanned over 550,000 .net domains, and extracted 20 distinct features for each of the domains. By analyzing the obtained DNS dataset, we observed several new findings and confirmed some new trends reported in the previous researches. Moreover, our experimental result showed that the prototype of ADAPT has a potential to outperform the existing detection systems, with a few modifications and updates in the detection process

Hameçonnage bancaire : un cadre d’analyse et de réduction de risque de victimisation

RÉSUMÉ : La fraude bancaire, tout particulièrement celle qui implique l’hameçonnage, reste un enjeu majeur de la relation qu’entretiennent les banques avec leurs clients. Les statistiques croissantes sur les montants dérobés des comptes des victimes et la multiplicité des contremesures, des organismes nationaux et des coalitions multinationales d’entreprises qui luttent contre ce fléau en sont deux indicateurs de l’étendue du phénomène. Ce constat nous a amenés à aborder dans cette thèse, les questions des facteurs de risque de victimisation et des améliorations à apporter aux contremesures afin d’en diminuer les impacts. A été étudiée en premier, la question de savoir quels sont les éléments nécessaires et suffisants à la définition de la victimisation par hameçonnage bancaire. Nous avons répondu à cette question en proposant un ensemble cohérent de quatre éléments sur lesquels doit s’appuyer toute définition de la victimisation par hameçonnage bancaire, notamment, l’action posée, l’objet utilisé, les présumés victimes et la nature des préjudices subis par lesdites victimes. Sur la base de ces éléments, nous avons défini trois formes de victimisation : la tentative d’hameçonnage, l’infection et la fraude. Prenant appui sur ces trois formes de victimisation, nous avons développé un modèle de régression logistique pour analyser les données d’une vaste enquête canadienne (Enquête ESG, 2009) sur la victimisation en ligne afin d’identifier et classer hiérarchiquement les facteurs clés de risque de tentative d’hameçonnage, d’infection et de fraude (cf. Tableau 5.1). Il en ressort que les comportements à risque en ligne, de même que le manque de formation de base en sécurité et de sensibilisation aux menaces sont les catégories ayant le plus d’importance dans l’explication de la victimisation par tentative d’hameçonnage et par infection. Quant aux facteurs qui contribuent à la fraude (retrait de l’argent des comptes des victimes), les données de l’enquête ESG 2009 ne permettant pas d’étudier le processus de monétisation - manque de données sur le marché noir des renseignements volés -, nous avons développé un modèle théorique pour étudier les comportements de deux acteurs de ce marché noir : le fraudeur et la mule. Pour ce faire, nous avons appliqué la théorie du choix rationnel développée en économie. Aussi, les fonctions d’utilité classique de type CRRA (Constant Relative Risk Aversion) et de type CARA (Constant Absolute Risk Aversion) ont été utilisées pour étudier le comportement du fraudeur vis-à-vis du risque. Enfin, pour tester notre modèle théorique, nous avons exploité des données colligées des forums clandestins. Les résultats de simulation de ce modèle révèlent que six facteurs ont une influence, à des degrés divers, sur le processus de monétisation. Il y a le revenu anticipé du fraudeur, l’intensité du niveau des mesures de sécurité mises en place par les banques, la commission versée à la mule, le prix du renseignement, la richesse initiale du fraudeur et la probabilité de se faire arrêter. Afin d’évaluer la pertinence de notre modèle théorique pour répondre à notre question de recherche sur les facteurs clés de risque de victimisation, une enquête basée sur un échantillon par choix raisonné a été menée auprès de dix-sept experts en sécurité informatique. Les résultats de cette enquête confirment que deux des six facteurs déterminés par notre modèle théorique ont une grande importance dans le processus de monétisation. Il s’agit du revenu anticipé du fraudeur et du niveau de mesures mises en place par les banques. Deux autres facteurs que nous n’avons pas mesurés dans notre modèle, faute de données et de métriques, ont été retenus par les experts comme étant des facteurs ayant des effets prépondérants sur la décision de monétiser ou non un renseignement volé : la qualité du renseignement et le temps écoulé entre le vol du renseignement et le retrait de l’argent du compte de la victime. Dans la même enquête, nous avons demandé aux experts de proposer des améliorations à apporter aux contremesures actuelles afin de réduire les risques de victimisation inhérents aux facteurs que nous avons déterminés. L’analyse des réponses des experts a permis d’adresser vingt-cinq recommandations aux pouvoirs publics, à l’utilisateur final, aux entreprises, aux développeurs de solutions de sécurité et aux organismes qui luttent contre l’hameçonnage bancaire. Le modèle micro-économique que nous avons proposé est la principale contribution théorique de cette recherche. Quant à la principale contribution pratique, elle a été de proposer, en se basant sur les avis des experts, des améliorations à apporter aux contremesures actuelles afin de réduire, le cas échéant, le risque d’hameçonnage bancaire. Cette recherche a toutefois quelques limites, notamment l’asymétrie d’information dans un marché noir de renseignements bancaires et le nombre limité des experts de l’enquête. Il serait intéressant à l’avenir de prendre en compte l’asymétrie d’information dans l’analyse du marché noir et de valider le modèle conçu avec plus de données empiriques colligées des forums, des banques et auprès des experts en sécurité informatique.----------ABSTRACT : Banking Fraud, specifically one which involves phishing, remains a major issue in the Relationship that banks maintain with their clients. The rising statistics on the amounts stolen from victims’ accounts as well as the multiplicity of countermeasures, the national organisations and the coalition of multinational businesses that fight against the plague, are two indicators of the extent of this phenomenon. This observation led us to examine in this thesis, the questions of victimisation risk factors and the improvements that can be made to countermeasures in order to diminish the impacts of phishing. We first examined the question of determining the necessary and sufficient elements required to define victimisation by banking phishing. We have answered this question by proposing a coherent ensemble of four elements on which any definition of victimisation by banking phishing must repose. These include the action, the objects used, the presumed victims and the nature of the prejudices suffered by said victims. On account of these elements, we have defined three forms of victimisation: phishing attempts, infection and fraud. On the basis of three forms of victimisation, we have developed a logistic regression model to analyse the data from an extensive Canadian investigation into online victimisation; in order to identify and hierarchically classify the key risk factors of phishing attempt, infection and fraud (Table 5.1). It appears that risky online behaviours, as well as the lack of basic training in security and threat sensitisation are the most important categories in the explanation of victimisation by attempt at phishing and by infection. As it related to factors that contribute to fraud (money withdrawal from victims’ accounts), the data from the ESG 2009 investigation does not allow for a study of the monetisation process – lack of data on the black market of stolen information. We have developed a theoretical model to study the behaviours of two players in the black market: the fraudster and the mule. To carry this out, we applied the rational choice theory developed in economics. Also, the classical utility functions of the CRRA (Constant Relative Risk Aversion) and CARA (Constant Absolute Risk Aversion) varieties are used to study the behaviour of the fraudster vis-à-vis risk. Finally, to test our theoretical model, we took advantage of the data gathered from clandestine sites. The results of the simulation of this model revealed that six factors influence, to different extents, the monetisation process. There is the anticipated revenue by the fraudster, the intensity of the level of security put in place by the banks, the commission paid to the mule, the price of the information, the initial wealth of the fraudster and the probability of getting caught. To evaluate the pertinence of our theoretical model in answering our research question on the key risk factors of victimisation, an investigation based on the rational choice sample has been performed among seventeen experts in information security. The results of this investigation confirmed that two out of six factors determined by our theoretical model have significant influence on the monetisation process. These include the anticipated revenue by the fraudster and the level of measures put in place by banks. Two other factors that we have not measured in our model, due to a lack of data and metrics, have been retained by the experts as factors having dominating effects on the decision to monetise or not stolen information: the quality of the information and the time elapsed since the theft as well as the withdrawal of money from the account by the victim. In the same investigation, we have asked experts to suggest improvements that can be made to the actual countermeasures in order to reduce the inherent victimisation risks that we have determined. The analysis of the experts’ responses has enabled us to provide twenty-five recommendations to authorities, the final user, businesses, security solutions developers and organisations that fight against banking phishing

Fast flux botnet detection based on adaptive dynamic evolving spiking neural network

A botnet, a set of compromised machines controlled distantly by an attacker, is the basis of numerous security threats around the world. Command and Control (C&C) servers are the backbone of botnet communications, where the bots and botmaster send reports and attack orders to each other, respectively. Botnets are also categorised according to their C&C protocols. A Domain Name System (DNS) method known as Fast-Flux Service Network (FFSN) is a special type of botnet that has been engaged by bot herders to cover malicious botnet activities, and increase the lifetime of malicious servers by quickly changing the IP addresses of the domain name over time. Although several methods have been suggested for detecting FFSNs domains, nevertheless they have low detection accuracy especially with zero-day domain, quite a long detection time, and consume high memory storage. In this research we propose a new system called Fast Flux Killer System (FFKA) that has the ability to detect “zero-day” FF-Domains in online mode with an implementation constructed on Adaptive Dynamic evolving Spiking Neural Network (ADeSNN) and in an offline mode to enhance the classification process which is a novelty in this field. The adaptation includes the initial weight, testing criteria, parameters customization, and parameters adjustment. The proposed system is expected to detect fast flux domains in online mode with high detection accuracy and low false positive and false negative rates respectively. It is also expected to have a high level of performance and the proposed system is designed to work for a lifetime with low memory usage. Three public datasets are exploited in the experiments to show the effects of the adaptive ADeSNN algorithm, two of them conducted on the ADeSNN algorithm itself and the last one on the process of detecting fast flux domains. The experiments showed an improved accuracy when using the proposed adaptive ADeSNN over the original algorithm. It also achieved a high detection accuracy in detecting zero-day fast flux domains that was about (99.54%) in an online mode, when using the public fast flux dataset. Finally, the improvements made to the performance of the adaptive algorithm are confirmed by the experiments

Reducing the risk of e-mail phishing in the state of Qatar through an effective awareness framework

In recent years, cyber crime has focused intensely on people to bypass existing sophisticated security controls; phishing is one of the most common forms of such attack. This research highlights the problem of e-mail phishing. A lot of previous research demonstrated the danger of phishing and its considerable consequences. Since users behaviour is unpredictable, there is no reliable technological protective solution (e.g. spam filters, anti-viruses) to diminish the risk arising from inappropriate user decisions. Therefore, this research attempts to reduce the risk of e-mail phishing through awareness and education. It underlines the problem of e-mail phishing in the State of Qatar, one of world s fastest developing countries and seeks to provide a solution to enhance people s awareness of e-mail phishing by developing an effective awareness and educational framework. The framework consists of valuable recommendations for the Qatar government, citizens and organisations responsible for ensuring information security along with an educational agenda to train them how to identify and avoid phishing attempts. The educational agenda supports users in making better trust decisions to avoid phishing that could complement any technical solutions. It comprises a collection of training methods: conceptual, embedded, e-learning and learning programmes which include a television show and a learning session with a variety of teaching components such as a game, quizzes, posters, cartoons and a presentation. The components were tested by trial in two Qatari schools and evaluated by experts and a representative sample of Qatari citizens. Furthermore, the research proves the existence and extent of the e-mail phishing problem in Qatar in comparison with the UK where people were found to be less vulnerable and more aware. It was discovered that Qatar is an attractive place for phishers and that a lack of awareness and e-law made Qatar more vulnerable to the phishing. The research identifies the factors which make Qatari citizens susceptible to e-mail phishing attacks such as cultural, country-specific factors, interests and beliefs, religion effect and personal characteristics and this identified the need for enhancing Qatari s level of awareness on phishing threat. Since literature on phishing in Qatar is sparse, empirical and non-empirical studies involved a variety of surveys, interviews and experiments. The research successfully achieved its aim and objectives and is now being considered by the Qatari Government