This document discusses using spatial statistics and machine learning classifiers to detect botnet command and control (C2) servers through DNS lookups. It aims to accurately detect botnet traffic with no prior knowledge, being lightweight, fast, and adaptable. The document examines using spatial measures like nearest neighbors analysis and Moran's and Geary's indices on the locations of IP addresses for DNS lookups. This is used to train classifiers to distinguish between benign and fast-flux botnet domains. The classifiers achieved over 95% accuracy and were shown to have minimal performance impact when processing 20,000 domains in under 13 seconds.

1. DNS Based Botnet
C2 Server Detection
Spatial Statistics as a detection metric

2. whois
@kamp_staaldraad
etienne@sensepost.com

3. https://www.team-cymru.org/images/conficker-2009-01-29-dark-full.jpg
Geographic Analysis

4. Research Goals
● Accurately detect botnet traffic
○
○
○
○
Assume no prior knowledge
Lightweight
Fast
Adaptable
● Early detection

5. Web Browsing
DNS
P2P
Mail
Practically Everything
Bots
Examining DNS

6. DNS Fast-Flux
●
Short TTL
●
Multiple A
Records
●
Different IP
Ranges

7. DNS Fast-Flux
●
●
●
●
Multiple ASNs
Multiple Countries
Multiple Timezones
Multiple Unique Location Identifiers

8. Widely Dispersed Networks

9. Spatial Statistics
Spatial Measures
http://earth-info.nga.mil/GandG/coordsys/images/MGRS_1km_Polygon_Shapefiles_Coverage.jpg

10. Spatial Measures

11. Nearest Neighbours
Fast-Flux Domains
Benign Domains

12. Spatial Statistics
Spatial Statistics
https://upload.wikimedia.org/wikipedia/commons/c/c7/Snow-cholera-map.jpg

13. First Law of Geography
"All things are related, but near things are more
related than far things." - W. Tobler

14. Autocorrelation

15. Moran's Index

16. Geary's Coefficient

17. Building the Classifiers

18. Classifier Training
Benign Dataset
Fast-Flux
Dataset

19. Classifier Training
Moran's I: Timezones

20. Moran's I: UTM

21. Geary's C: UTM

22. Geary's C: MGRS

23. Classifier Results

24. Moran Classifier Results
97% Timezones
UTM 95%
95% MGRS
Accuracy

25. Geary Classifier Results
95% Timezones
UTM 96%
95% MGRS
Accuracy

26. Evaluating Performance
● Determine resource usage
● Impact on normal network performance
● Scalability

27. Classifier Performance Impact
http://beyond.customline.com/wp-content/uploads/2012/04/Cheetah-performance.jpg

28. Measured Performance

29. Measured Performance
20,000 domain lookups
Processed in
-4
13 seconds
6.501×10 seconds per domain

30. Benefits
Fast
Small
Low maintenance
Scalable

31. Future Work
● Combine classifiers into stand-alone solution
● Combine detection and blocking
● Increase accuracy of geo-location

32. Conclusion
@kamp_staaldraad
etienne@sensepost.com