A Comprehensive Measurement Study of Domain Generating Malware
A Comprehensive Measurement Study of Domain Generating Malware
复制标题
DOI：
--
复制
发表时间：
2016-08
影响因子：
8.6
通讯作者：
D. Plohmann;Khaled Yakdan;Michael Klatt;Johannes Bader;E. Gerhards-Padilla
中科院分区：
文献类型：
--
作者：
D. Plohmann;Khaled Yakdan;Michael Klatt;Johannes Bader;E. Gerhards-Padilla
近年来，现代僵尸网络广泛采用域生成算法（DGA）。主要目标是生成大量域名，然后使用一小部分用于实际的C&C通信。这使得DGAs对僵尸网络管理员来说非常有吸引力，他们需要加强僵尸网络的基础设施，并使其能够抵御黑名单和攻击（如关闭努力）。虽然早期的DGAs被用作备份通信机制，但一些新的僵尸网络将其作为主要通信方法，因此详细研究DGAs非常重要。在本文中，我们通过分析43个基于DGA的恶意软件家族和变体，对DGA景观进行了全面的测量研究。我们还提出了一种DGAs的分类方法，并用它来表征和比较所研究的家族的性质。通过重新实现算法，我们预先计算了它们生成的所有可能域，涵盖了大多数已知和活动的DGAs。然后，我们研究了超过1800万个DGA域的注册状态，并表明通过预计算未来的DGA域，可以可靠地识别相应的恶意软件家族和相关活动。我们还深入了解了僵尸管理员关于域名注册的策略，并确定了以前基于dga的僵尸网络的拆除工作中的几个陷阱。我们将为未来的研究共享数据集，并将提供一个web服务来检查潜在的DGA身份域。
Recent years have seen extensive adoption of domain generation algorithms (DGA) by modern botnets. The main goal is to generate a large number of domain names and then use a small subset for actual C&C communication. This makes DGAs very compelling for botmasters to harden the infrastructure of their botnets and make it resilient to blacklisting and attacks such as takedown efforts. While early DGAs were used as a backup communication mechanism, several new botnets use them as their primary communication method, making it extremely important to study DGAs in detail. In this paper, we perform a comprehensive measurement study of the DGA landscape by analyzing 43 DGA-based malware families and variants. We also present a taxonomy for DGAs and use it to characterize and compare the properties of the studied families. By reimplementing the algorithms, we pre-compute all possible domains they generate, covering the majority of known and active DGAs. Then, we study the registration status of over 18 million DGA domains and show that corresponding malware families and related campaigns can be reliably identified by pre-computing future DGA domains. We also give insights into botmasters' strategies regarding domain registration and identify several pitfalls in previous takedown efforts of DGA-based botnets. We will share the dataset for future research and will also provide a web service to check domains for potential DGA identity.