Botnet Detection by Monitoring Group Activities in DNS Traffic

TLDR

Botnets, large pools of compromised hosts used for spam, data theft, and DDoS, have grown in popularity and existing defenses struggle to keep pace with their rapid evolution. The study proposes detecting botnets by monitoring DNS traffic for simultaneous group activity among distributed bots. The authors develop an anomaly‑based detection system that identifies botnet activity by analyzing simultaneous DNS query patterns from distributed bots. Experiments on a campus network show the method outperforms prior approaches, reliably detecting botnets during server connections or migrations.

Abstract

Recent malicious attempts are intended to get financial benefits through a large pool of compromised hosts, which are called software robots or simply "bots." A group of bots, referred to as a botnet, is remotely controllable by a server and can be used for sending spam mails, stealing personal information, and launching DDoS attacks. Growing popularity of botnets compels to find proper countermeasures but existing defense mechanisms hardly catch up with the speed of botnet technologies. In this paper, we propose a botnet detection mechanism by monitoring DNS traffic to detect botnets, which form a group activity in DNS queries simultaneously sent by distributed bots. A few works have been proposed based on particular DNS information generated by a botnet, but they are easily evaded by changing bot programs. Our anomaly-based botnet detection mechanism is more robust than the previous approaches so that the variants of bots can be detectable by looking at their group activities in DNS traffic. From the experiments on a campus network, it is shown that the proposed mechanism can detect botnets effectively while bots are connecting to their server or migrating to another server.