Botnets are a group of computers infected with a specific sub-set of a malware family
and controlled by one individual, called botmaster. This kind of networks are used not
only, but also for virtual extorsion, spam campaigns and identity theft. They implement
different types of evasion techniques that make it harder for one to group and detect
botnet traffic.
This thesis introduces one methodology, called CONDENSER, that outputs clusters
through a self-organizing map and that identify domain names generated by an unknown
pseudo-random seed that is known by the botnet herder(s). Aditionally DNS
Crawler is proposed, this system saves historic DNS data for fast-flux and double fastflux detection, and is used to identify live C&Cs IPs used by real botnets. A program, called CHEWER, was developed to automate the calculation of the SVM parameters and features that better perform against the available domain names associated with DGAs.
CONDENSER and DNS Crawler were developed with scalability in mind so the detection
of fast-flux and double fast-flux networks become faster.
We used a SVM for the DGA classififer, selecting a total of 11 attributes and achieving a Precision of 77,9% and a F-Measure of 83,2%. The feature selection method identified the 3 most significant attributes of the total set of attributes. For clustering, a Self-Organizing Map was used on a total of 81 attributes.
The conclusions of this thesis were accepted in Botconf through a submited article.
Botconf is known conferênce for research, mitigation and discovery of botnets tailled for the industry, where is presented current work and research. This conference is known for having security and anti-virus companies, law enforcement agencies and researchers