View source for Measuring and detecting Fast-Flux service networks

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://pi1.informatik.uni-mannheim.de/filepool/publications/fast-flux-ndss08.pdf  uni-mannheim.de (pdf)
|Author=Thorsten Holz, Christian Gorecki, Konrad Rieck, Felix C. Freiling, 
|NomRevue=
|Date=
|Editor=University of Mannheim & Fraunhofer FIRST
|Year=2008
|ISBN=
|Page=
|Abstract=We present the ﬁrst empirical study of fast-ﬂux service networks (FFSNs), a newly emerging and still not widelyknown phenomenon in the Internet. FFSNs employ DNS to establish a proxy network on compromised machines through which illegal online services can be hosted with very high availability. Through our measurements we show that the threat which FFSNs pose is signiﬁcant: FFSNs occur on a worldwide scale and already host a substantial percentage of online scams. Based on analysis of the principles of FFSNs, we develop a metric with which FFSNs can be effectively detected. Considering our detection technique we also discuss possible mitigation strategies.
|Botnet=Storm, 
|Malware=Storm Worm, 
|CCProtocol=, 
|Operation=, 
|Keyword=RRDNS, FFSN, 
}}