[PDF] [PDF] sinkholes - USENIX

[PDF] Using DNS to protect clients from malicious - Boston University

Malware Domain List Zeus Tracker REN-ISAC DNS Leverage: Reputation Page 4 Without DNS Sinkhole vanilla DNS Are you using a DNS Sinkhole? ❖

[PDF] sinkholes - USENIX

Seed list of sinkhole IPs historic domain-‐IP mappings Travel back in i m e C&C IPs after known sink IPs B ack to the future Passive DNS DB • Other known 

[PDF] Cracking the Wall of Confinement: Understanding and - NDSS

24 fév 2019 · sinkhole lists, eight domain blacklists, passive DNS (PDNS) data that More specifically, we manually build a list of sinkhole nameservers and 

[PDF] Block DNS with Security Intelligence using Firepower - Cisco

At the end of this document, an optional Sinkhole configuration is also demonstrated Network Diagram Configure Configure a custom DNS List with the domains 

[PDF] DNS Policies - Cisco

Traffic on a Block list is dropped without further inspection You can also return a Domain Not Found response, or redirect the DNS query to a sinkhole server

[PDF] SinkMiner: Mining Botnet Sinkholes for Fun and Profit 1 - covertio

tect proprietary black lists of remediated domains unknown sinkhole IPs and the related sinkholed sinkhole IPs, we can leverage passive DNS databases

[PDF] AUTOMATING THREAT DETECTION & RESPONSE - Black Hat

Reverse DNS Tunnelling Shellcode • Black Hat The Active Directory Botnet Integrate with NextGen FW, DNS Sinkhole, Threat Intel Gateway, SIEM

[PDF] USING DNS TO PROTECT CLIENTS FROM MALICIOUS - IDRBT

In DNS sinkhole, we create two lists called white list and black list Malicious URLs can be collected from already known C&C servers, through the open source 

[PDF] dns sinkhole software

[PDF] dns sinkhole windows

[PDF] dns spoof script

[PDF] do 2011 jeep grand cherokees have easter eggs

[PDF] do 2d shapes have faces

[PDF] do all companies need to be audited

[PDF] do all laptops have cancer warning

[PDF] do amines react with hcl

[PDF] do apa references end with a period

[PDF] do b cells make cytokines

[PDF] do b cells make immunoglobulins

[PDF] do b cells make peptide molecules

[PDF] do black ants bite

[PDF] do british airways fly from cardiff

[PDF] do carboxylic acid react with water

NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

SinkMiner

MiningBotnetSinkholesforFunandProfit

BabakRahbarinia

1 ,RobertoPerdisci 1,2 ,ManosAntonakakis 3 ,DavidDagon 2 1

UniversityofGeorgia

2

GeorgiaTechInformaGonSecurityCenter,

3

DamballaLabs

NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

BotnetSinkholes

• Sinkholes:takeoverthebotnet! - disablethebotnet- EnumeratevicGms,studyC&Cprotocol,etc. • Examples - YourBotnetisMyBotnet(ACMCCS2009)- ConfikerWorkingGroup-LessonsLearned- etc...

C&CSinkhole

NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

SinkMiner

• Wherearethesinkholes? • Whydoyouevencare?!? - measuringeffec:veC&CdomainlifeGme sinkholenon-routable/NXtesGngC&C NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

SinkMiner

• Otherbenignreasonstocare - Avoidfriendlyfire • Notsobenignreasons - Iwantyourdomainblacklist! NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

MiningSinkholes

• Surprisingly,sinkholeddomainso_enrelocatedfromasinkholeIPtoanother! - Wethoughttheywouldstayput! • Idea - followtheevoluGonofsinkholeddomains NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

SinkMinerSystemOverview

SeedlistofsinkholeIPshistoricdomain-IPmappingsTravelbackinGme...C&CIPsa_erknownsinkIPsBacktothefuture!PassiveDNSDB• Otherknownsink• Newsink• Parking• NXrewriGng• other?

NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

PreliminaryLabeling

• UsingasetofheurisGcs: - Nameservernames • IPsresolvedbyns1.sinkhole.charesinkholes - Also,torpig-sinkhole.org,dns3.sinkdns.net, sinkhole-00.shadowserver.org,... • IPsresolvedbynx1.dnspark.netareparking - Also,dns1.ns-park.net,park1.dns.ws, one.parkingservice.com,... NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

PreliminaryLabeling

• NX-rewriGngIPs - IPsthatarepointedtobylotsofnon-existentand/ orinvaliddomainnames - Verylargevolumesofdomains • all"invalid"resoluGonsfromenGrenetworks DNS

NX Domainwww.invalid.ex ?www.invalid.ex ?

68.87.74.166

NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

PreliminaryLabeling

• VolumeofdomainsperIP - ObservaGon:sameknownsinkholeIPsused(in

Gme)totakedownlotsofdomains

- HeurisGcs:

• IPspointedtobylotsofdomainsareprobablysinkholes• EspeciallyiftheyareinthesameASasknownsinkholes

NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

Graph-basedLabeling

Si 2 Si 1 Si n St 1 St 2 St m IP x Wi 1 Wi 2 Wi n Wt 1 Wt 2 Wt m #ofdomainsSi 1 -->IP x NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

Graph-basedLabeling

Si 2 Si 1 Si n St 1 St 2 St m IP x Wi 1 Wi 2 Wi n Wt 1 Wt 2 Wt m #ofdomainsSi 1 -->IP x IP y W xy NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

IniGalSinkholes

• 22knownsinkholes(19differentASes) - 2,945,483sinkholeddomainsformpassiveDNS- 130,901a_erpruningDGAdomains • 39%of130,901domainschangedIPa_erthey weresinkholed • PotenGalsinkholes5,576 NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

PreliminaryLabeling

• Nameservernames - 475parkingIPs- 15sinkholeIPs• 7NX-rewriGngIPs • Popularity+ASname - 23highlypopularsinkholes

Expandedseedlistfrom22to60

NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

Graph-basedLabeling

• Graph:>5knodesand>164kedges • 49newsinkholes - 12using1 st

GDBquery+37with2

nd

GDBquery

Someexamples...

Overall:87newlikelysinkholes

NIS etworkntelligenceecurity

University of Georgia

Dept. of Computer Science

perdisci@cs.uga.eduquotesdbs_dbs14.pdfusesText_20