An Improvement for Fast-Flux Service Networks Detection Based on Data Mining Techniques

  • Ziniu Chen
  • Jian Wang
  • Yujian Zhou
  • Chunping Li
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6743)


Fast-flux is a kind of DNS technique used by botnets to hide the actual location of malicious servers. It is considered as an emerging threat for information security. In this paper, we propose an approach to detect the fast-flux service network (FFSN) using data mining techniques. Furthermore, we use the resampling technique to solve imbalanced classification problem with respect to FFSNs detection. Experiment results in the real datasets show that our approach improves the detective precision and effectiveness compared with existing researches.


Random Forest Rate Flux Data Mining Technique Detective Precision Malicious Server 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Castelluccia, C., Kaafar, M.A., et al.: Geolocalization of Proxied Services and its Application to Fast-Flux Hidden Servers. In: Proceedings of IMC 2009, November 4-6, pp. 184–189 (2009)Google Scholar
  2. 2.
    Jose, N., Thorsten, H.: As the Net Churns: Fast-Flux Botnet Observations. In: Proceedings of Int’l Conf, Malicious and Unwanted Software (Malware), pp. 24–31. IEEE Press, Los Alamitos (2008)Google Scholar
  3. 3.
    ICANN Security and Stability Advisory Committee.: SAC 025: SSA Advisory on Fast Flux Hosting and DNS (March 2008),
  4. 4.
    Alper, C., Mike, T., et al.: Real-time detection of fast-flux service networks. In: Cybersecurity Applications & Technology Conference for Homeland Security, pp. 285–292 (2009)Google Scholar
  5. 5.
    The Honeynet Project.: Know Your Enemy: Fast-Flux Service Networks (2008),
  6. 6.
    Caglayan, A., Toothaker, M., et al.: Behavioral analysis of Fast Flux Service Networks. In: CSIIRW 2009, April 13-15 (2009)Google Scholar
  7. 7.
    Holz, T., Gorecki, C., et al.: Measuring and Detecting Fast-Flux Service Networks. In: Proceedings of the Network & Distributed System Security Symposium (2008)Google Scholar
  8. 8.
    Emanuele, P., Roberto, P., et al.: Fluxor: detecting and monitoring fast-flux service networks. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol. 5137, pp. 186–206. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  9. 9.
    Wu, J., Zhang, L., et al.: A Comparative Study for Fast-Flux Service Networks Detection. In: Proceeding - 6th International Conference on Networked Computing and Advanced Information Management, NCM, pp. 346–350 (2010)Google Scholar
  10. 10.
    Sami, A., Yadegari, B., et al.: Malware Detection Based on Mining API Calls. In: Proceedings of SAC 2010, pp. 1020–1025 (2010)Google Scholar
  11. 11.
    Internet Software Consortium.: Dig: domain information groper (September 2007),
  12. 12.
    Yu, S., Zhou, S., et al.: Fast-flux Attach Network Identification Based on Agent Lifespan. In: IEEE International Conference on Digital Object Identifier, Wireless Communications, Networking and Information Security (WCNIS), pp. 658–662 (2010)Google Scholar
  13. 13.
    Do, H.-H., Melnik, S., et al.: Comparision of schema matching evaluations. In: Proceedings of Web, Web-Services and Database Systems, pp. 221–337 (2002)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Ziniu Chen
    • 1
  • Jian Wang
    • 1
  • Yujian Zhou
    • 2
  • Chunping Li
    • 1
  1. 1.Data Mining Group, School of SoftwareTsinghua UniversityBeijingChina
  2. 2.MOST Information CenterBeijingChina

Personalised recommendations