Citation Context

...ate the resulting False Positive Rate (FPR) [3], as defined according to the following formula: ...

Citation Context

...ely, attack detection by monitoring DNS is just starting to get the attention it deserves. Malware employing spamming services can easily be detected by their emission of a large number of MX queries =-=[6]-=-. Botnet activity can be inferred via DNS query patterns and maintained blacklists [7,8]. Correlation of DNS activity with regular IP traffic can even be used to detect malware scanning and zero-day w...

Citation Context

...works [7]. Therefore, network operators are required to find infected hosts in their networks to stop malicious activities. To find infected hosts, methods of monitoring DNS traffic has been proposed =-=[10, 4, 6]-=-. When a bot attempts to connect to a C&C or malware-hosting server, it sends a DNS query to resolve domain names of these server. Therefore, given domain names of C&C or malwarehosting servers, we ca...

Citation Context

... similar to Schonewille’s, which monitors DNSstraffic on the Internet link is needed in order to detect clients resolving names using othersDNS servers than those officially provided.sIshibashi et al =-=[13]-=- used DNS traffic to detect mass mailing worm infected machines.sTheir approach is based on the number of queries issued for MX records which indicatessmachines that are trying to send e-mails to diff...

Citation Context

...determine the rules embedded in the fixed-length patterns. Lee’s method can effectively reduce the amount of data, but data characteristics of the problem are the same as in Forrest. Ishibashi et al. =-=[18]-=- proposed a DNS traffic mining method to detect a mass-mailing worm. This works because before a virus sends mails to the targets, queries are sent to local DNS servers to find the appropriate mail se...

Citation Context

...ch to detecting DNS spoofing, cache poisoning, Denial of Service attacks and compromised servers based on sampling packets [110]. Ishibashi et al used traffic aggregation to detect mass mailing worms =-=[54]-=- and Whyte et al used a similar approach to detect worm 117 scanning on an enterprise network [113]. Jo et al [57], Le et al [62] and Prakash et al [87] each explored various heuristics methods to dis...

Citation Context

...e event, in this case n` = t`. For a detected event, we define the detection delay T deti,` , n` − t`. Given a sequence of N events, eN , (e1, e2, . . . , eN ) , we denote by Edeti (eN ) and N det i the set and number of events detected by learner i, respectively. We define the misdetection probability Pi(eN ) of learner i as the average number of undetected events, Pi(eN ) , N −Ndeti N , (4) and we define the delay Di(eN ) of learner i as the average detection delay, Di(eN ) , ∑ `∈Edeti T det i,` Ndeti . (5) 4A single Internet Service Provider can receive thousands of DNS queries each second [26]. 5 In order to incorporate these two measures in a single performance metric, we consider the following cost function, Ci(eN ) , Pi(eN ) + αDi(eN ) . (6) The trade-off parameter α is a design parameter which is used to trade-off between detection accuracy and delay. The value of α must be small if the considered application does not require timely detections, whereas it must be large if it is essential to detect an event in a timely manner. In the next subsections we design the cluster level selection rule and the weight vector update rule in order to minimize the cost Ci(eN ). Note that ther...