DETECTING NETWORK ANOMALIES IN ISP NETWORK USING DNS AND NETFLOW Page 61 of 65
REFERENCES
Aaron, G. and Rasmussen, R., “Global Phishing Survey : Trends and Domain Name Use in 2H2013,” Apwg, (April) pp. 1–31, 2014, URL http://docs.apwg.org/
reports/APWG{_}GlobalPhishingSurvey{_}2H2013.pdf.
Bilge, L., Kirda, E., Kruegel, C., Balduzzi, M., and Antipolis, S., “EXPOSURE : Finding Malicious Domains Using Passive DNS Analysis,” Ndss, pp. 1–17, 2011, URL http://scholar.google.com/scholar?hl=en{&}btnG=
Search{&}q=intitle:EXPOSURE+:+Finding+Malicious+Domains+
Using+Passive+DNS+Analysis{#}0.
Chellappa, R. K. and Pavlou, P. A., “Perceived information security, financial li- ability and consumer trust in electronic commerce transactions,” Logistics Infor- mation Management, volume 15(5/6) pp. 358–368, 2002, URL http://www.
emeraldinsight.com/doi/10.1108/09576050210447046.
Chen, C.-M., Huang, M.-Z., and Ou, Y.-H., “Detecting hybrid botnets with web com- mand and control servers or fast flux domain,”Journal of Information Hiding and Mul- timedia Signal Processing, volume 5(2) pp. 262–273, 2014.
Christodorescu, M., Jha, S., Seshia, S. A., Song, D., and Bryant, R. E., “Semantics- Aware Malware Detection,” , 2005.
Creswell, J.,Educational research: Planning, conducting, and evaluating quantitative and qualitative research, Upper Saddle River, NJ: Prentice Hall, 3rd edition, 2008.
Eastlake 3rd, D., “Domain name system (DNS) IANA considerations,” , 2013.
Frosch, T., Kührer, M., and Holz, T., “Predentifier: Detecting Botnet C&C Domains From Passive DNS Data,” Hgi.Ruhr-Uni-Bochum.De, pp. 1–
14, ????, URL http://hgi.ruhr-uni-bochum.de/media/emma/
veroeffentlichungen/2013/10/31/predentifier.pdf.
Fulton, S., “Top 10 DNS attacks likely to infiltrate your network,” , 2015, URL https://www.networkworld.com/article/2886283/security0/
top-10-dns-attacks-likely-to-infiltrate-your-network.
html{#}slide2.
Andreas Tedja
DETECTING NETWORK ANOMALIES IN ISP NETWORK USING DNS AND NETFLOW Page 62 of 65
Guy, K. O., Raviv, P., and Matzliach, “Digging Deeper - An in-depth analysis of a fast flux network,” pp. 1–17, 2017.
Hananto, R., Technology, I., and Technology, I., “DETECTING NEW NETWORK SECURITY THREATS,” (15), 2017.
Holz, T., Gorecki, C., Rieck, K., and Freiling, F. C., “Measuring and Detecting Fast- Flux Service Networks,”Ndss, pp. 24 – 31, 2008.
Jain, R., “Application Layer - Computer Science & Engineering,” , 2011.
Kadir, A. F. A., Othman, R. A. R., and Aziz, N. A., “Behavioral analysis and visu- alization of Fast-Flux DNS,” Proceedings - 2012 European Intelligence and Security Informatics Conference, EISIC 2012, pp. 250–253, 2012.
Khattak, S., Ramay, N. R., Khan, K. R., Syed, A. A., and Khayam, S. A., “A Taxon- omy of botnet behavior, detection, and defense,” IEEE Communications Surveys and Tutorials, volume 16(2) pp. 898–924, 2014.
Kim, B.-K.,Internationalising the Internet the Co-evolution of Influence and Technol- ogy, Edward Elgar, 2005.
Lin, H. T., Lin, Y. Y., and Chiang, J. W., “Genetic-based real-time fast-flux service networks detection,” Computer Networks, volume 57(2) pp. 501–513, 2013, URL http://dx.doi.org/10.1016/j.comnet.2012.07.017.
Ma, J., Saul, L. K., Savage, S., and Voelker, G. M., “Beyond Blacklists : Learning to Detect Malicious Web Sites from Suspicious URLs,” World Wide Web Internet And Web Information Systems, pp. 1245–1253, 2009, URLhttp://portal.acm.org/
citation.cfm?id=1557153.
Mahjoub, D., “Monitoring a fast flux botnet using recursive and passive DNS: A case study,”eCrime Researchers Summit, eCrime, 2013.
Mahmoud, M., Nir, M., and Matrawy, A., “A Survey on botnet architectures, detection and defences,” International Journal of Network Security, volume 17(3) pp. 272–289, 2015.
Marchal, S., Francois, J., Wagner, C., State, R., Dulaunoy, A., Engel, T., and Festor, O.,
“DNSSM: A Large Scale Passive DNS Security Monitoring Framework,” , 2012.
Martinez-Bea, S., Castillo-Perez, S., and Garcia-Alfaro, J., “Real-time malicious fast- flux detection using DNS and bot related features,” 2013 11th Annual Conference on Privacy, Security and Trust, PST 2013, pp. 369–372, 2013.
Andreas Tedja
DETECTING NETWORK ANOMALIES IN ISP NETWORK USING DNS AND NETFLOW Page 63 of 65
Matt Prytuluk, “Common DNS return codes for any DNS service (and Umbrella),”
, 2016, URL https://support.umbrella.com/hc/en-us/articles/
232254248-Common-DNS-return-codes-for-any-DNS-service-and-Umbrella-.
Mills, D. L., Computer Network Time Synchronization: The Network Time Protocol, CRC Press, illustrate edition, 2006.
Mockapetris, P., “RFC 1034,” pp. 1–55, 1987a.
Mockapetris, P., “RFC 1035,” pp. 1–55, 1987b.
Nazario, J. and Holz, T., “As the net churns: Fast-flux botnet observations,”3rd Interna- tional Conference on Malicious and Unwanted Software, MALWARE 2008, pp. 24–31, 2008.
NTP Pool Project, “All Pool Servers,” , 2018, URLhttp://www.pool.ntp.org/
zone.
Overton, M., “Bots and botnets: Risks, issues and prevention,” in “Virus Bulletin Con- ference,” , 2005.
Perdisci, R., Corona, I., Dagon, D., and Lee, W., “Detecting malicious flux service net- works through passive analysis of recursive DNS traces,” Proceedings - Annual Com- puter Security Applications Conference, ACSAC, pp. 311–320, 2009.
Ranum, M. J., “Thinking About Firewalls,” pp. 1–10, 1994, URL http://csrc.
nist.gov/publications/secpubs/fwalls.pdf.
Snyder, D., “The very first viruses: Creeper, Wabbit and
Brain,” , 2010, URL http://infocarnivore.com/
the-very-first-viruses-creeper-wabbit-and-brain/.
Spamhaus, “Botnet Controllers in the Cloud,” , 2017,
URL https://www.spamhaus.org/news/article/736/
botnet-controllers-in-the-cloud.
Spamhaus, “ISP Spam Issues,” , 2018, URL https://www.spamhaus.org/
faq/section/ISP+Spam+Issues{#}164.
Spamhaus Malware Labs, “Spamhaus Botnet Threat Report 2017,” , 2018, URL https://www.spamhaus.org/news/article/772/.
Andreas Tedja
DETECTING NETWORK ANOMALIES IN ISP NETWORK USING DNS AND NETFLOW Page 64 of 65
Stalmans, E. and Irwin, B., “A framework for DNS based detection and mitigation of malware infections on a network,” 2011 Information Security for South Africa - Pro- ceedings of the ISSA 2011 Conference, 2011.
Statista, “Spending on cybersecurity in the United States from 2010 to 2018 (in bil- lion U.S. dollars),” , 2018, URLhttps://www.statista.com/statistics/
615450/cybersecurity-spending-in-the-us/.
The Internet Society, “Domain Name System (DNS) Parameters,” , 2003, URL http://www.iana.org/assignments/dns-parameters/
dns-parameters.xhtml.
University of Delaware, “Executive Summary: Computer Network Time Synchroniza- tion,” , 2012, URLhttps://www.eecis.udel.edu/{~}mills/exec.html.
Vinod, P., Jaipur, R., Laxmi, V., and Gaur, M., “Survey on malware de- tection methods,” Proceedings of the 3rd . . ., pp. 82–87, 2009, URL http://www.security.iitk.ac.in/hack.in/2009/repository/
proceedings{_}hack.in.pdf{#}page=82.
Weimer, F., “Florian Weimer’s Home Page,” , 2004, URLhttp://www.enyo.de/
fw/.
Xu, W. and Wang, X., “New Trends in FastFlux Networks,”Black Hat USA 2013, 2013.
Zhao, D. and Traore, I., “P2P botnet detection through malicious fast flux network identification,”Proceedings - 2012 7th International Conference on P2P, Parallel, Grid, Cloud and Internet Computing, 3PGCIC 2012, pp. 170–175, 2012.
Andreas Tedja
