Detecting Fast Flux Malicious Domains via DNS Record Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to detect and identify attack infrastructure used for large-scale cyber attacks, particularly those employing Fast Flux techniques that rapidly switch IP addresses and discard domains, making it difficult to differentiate between normal and malicious domains.
Innovation Solution
A detection program and information processing device that acquires domain information, analyzes record information from a second managing server to identify repeatedly used IP addresses and associated name servers, generating lists to efficiently detect malicious name servers and domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Fast Flux techniques are used to rapidly switch IP addresses and discard domains, then the attack infrastructure becomes more resilient and harder to detect, but it becomes difficult to differentiate between normal and malicious domains
Solution Approach 1:
The system proactively collects and stores DNS record information, IP address data, and domain registration details in advance before attacks occur. By pre-building a database of normal DNS behavior patterns and relationships, the system can quickly compare against suspicious activity during attacks, enabling rapid detection despite the dynamic nature of Fast Flux techniques
Solution Approach 2:
The system continuously monitors DNS queries and responses, comparing actual DNS resolution behavior against established baselines of normal behavior. When anomalies are detected (such as unusual IP address switching patterns or domain registration timing), the system feeds this information back into the analysis engine to dynamically update detection rules and identify malicious infrastructure
2Measurement precision
If existing methods calculate similarity of IP address-related information to generate domain sets, then some attack infrastructure can be identified, but the methods struggle to detect rapidly changing Fast Flux infrastructure
Solution Approach 1:
The system transitions from static similarity-based domain grouping to dynamic behavioral analysis. Instead of relying on fixed IP address similarity thresholds, the system continuously adapts to changing attack patterns by monitoring DNS query timing, frequency, and patterns. This enables detection of Fast Flux infrastructure through its characteristic rapid IP address rotation behavior, regardless of how the specific IP addresses change over time
Solution Approach 2:
The system adds temporal and behavioral dimensions to the analysis beyond simple IP address similarity. By examining when DNS queries occur, how frequently domains are registered or expired, and the patterns of IP address usage over time, the system creates a multi-dimensional profile that can distinguish malicious Fast Flux infrastructure from legitimate services even when they share similar IP addresses
Data Source
AI summary
A non-transitory computer-readable storage medium storing a detection program that causes a processor included in a noise estimation apparatus to execute a process, the process includes acquiring domain information included in cyber attack information, acquiring record information corresponding to the acquired domain information from a second managing server, the second managing server managing a response history of a first managing server by monitoring communication of the first managing server, the first managing server managing an association between domain information and an IP address, the response history being related to the association between the domain information and the IP address, identifying an IP address that is repeatedly used and a name server associated with the identified IP address by analyzing the record information, and outputting first list information indicating the identified IP address and the identified name server.