DMCA
Detection of Bot Worm-Infected PC Terminals
BibTeX
@MISC{Romaña_detectionof,
author = {Dennis A. Ludeña Romaña and Yasuo Musashi and Ryuichi Matsuba and Kenichi Sugitani},
title = {Detection of Bot Worm-Infected PC Terminals},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
The DNS query packet traffic in the topdomain DNS server for Ku-mamoto University were statistically investigated when infection of bot worm (BW) like W32/Mytob and W32/Zotob BWs were increased world-widely. The interesting results are: (1) The W32/Mytob.A BW-infected PC terminal sends only the A record based DNS query packets including several keywords of “mail”, “smtp”, “mx”, “ns”, “gate”, and “relay ” as their query contents. (2) The traffic of the abnormal client MX record based DNS query packet synchronizes with that of the abnormal ran-dom TCP access like ports of 135, 139, and/or 445 from the W32/Zotob BW-infected PC terminals. Thus, we can detect the IP addresses of the BW-infected PC terminals by watching the traffic of the DNS resolution access and the abnormal random TCP one.
Keyphrases
bot worm-infected pc terminal w32 mytob bw-infected pc terminal dns query packet topdomain dns server w32 zotob bw-infected pc terminal several keywords abnormal ran-dom tcp access w32 zotob bw bot worm interesting result dns query packet traffic ip address abnormal client mx record ku-mamoto university query content abnormal random tcp dns resolution access
