Inspecting DNS Flow Traffic for Purposes of Botnet Detection

Figure 2: Amount of DNS queries during one week period.5 ConclusionIn this internal deliverable, we focused on the possibility to use DNS flow trafficfor purposes of botnet detection. In the first part of deliverable, we providedthe description of the botnet generated traffic, we introduced existing methodsfor botnet detection using DNS traffic and we mentioned the set of features usedfor malicious traffic detection. The following part discussed the flow data itself,which have very limited amount of information about DNS queries comparedto the full packet payload. The analysis of one week traffic from real networkdemonstrated the lack of crucial information contained inside the NetFlow data.One feature, which we are able to monitor with current NetFlow data, isthe amount of DNS queries generated from local network against public DNSservers. The aberrant amount of DNS queries against these DNS servers mayindicate possible infection of local host by malware or botnet.To conclude, we have to state that using NetFlow data solely, for the purposesof botnet detection, is not possible. There are several ways how to solvethis problem. The most promising approach is to extract the important informationfrom packet payload (queried domain names, their TTLs, IP addresses,etc.), use newer IPFIX export format and add the extracted information to eachexported flow. In such situation, we are able to use existing botnet detectionmethods analyzing DNS traffic with advantage.6 References[1] Mitsuaki Akiyama, Takanori Kawamoto, Masayoshi Shimamura, TeruakiYokoyama, Youki Kadobayashi, Suguru Yamaguchi. A Proposal of Metricsfor Botnet Detection Based on Its Cooperative Behavior. Applicationsand the Internet Workshops, 2007. SAINT Workshops 2007. InternationalSymposium on, s 82, jan. 2007.[2] Leyla Bilge, Engin Kirda, Christopher Kruegel, Marco Balduzzi. EXPO-SURE: Finding Malicious Domains Using Passive DNS Analysis. NDSS,2011.8