Explore new trends in fast-flux networks as revealed by tracking and analyzing over 200 fast-flux domains. Discover how attackers have adapted their techniques, including slower IP address and name server change rates, sharing of resources among different malware families, and the emergence of "n-level" flux behavior. Learn about the underground economic model supporting fast-flux networks and compare these malicious techniques with benign applications using similar methods. Examine proposed detection approaches based on these new characteristics and gain insights into the evolving landscape of fast-flux domain usage in cybersecurity.
Overview
Syllabus
Intro
What we used to know
Slower Change Rate
Why Slower?
Sharing of IP and Name Servers
Why Sharing?
Two levels of sharing
Inter-malware-family IP sharing
One IP at A Time
Clustering
How the domains are connected
Inter-cluster connections
What can we learn from cluster?
What looks like Fast-Flux, but NOT
Characteristics of benign Fast-Flux
How do we collect the data?
What About Defense?
Taught by
Black Hat
