# Botnet Detection Technology Based on DNS
## 3 Botnet Detection Technology
### FF-Based Botnet Detection  
Nowadays, fast-flux is attracting more and more attention, and scientists have made great efforts to detect the damage caused by fast-flux based cyberattacks. Phishing websites and malware often use fast-flux services as proxies so that Internet users will not have access to upstream servers that contain reliable content. This is a deceptive behavior creating replicas of existing Web pages or other cyber resources to cheat a user to submit private information, such as their financial status, or PIN code. To hide these replicas, phishers need advanced technology and a high maintenance cost is involved. Fast-flux networks and DNS domain fluxing, as C and C mechanisms, are adopted to control bots, which can help botnets, such as Storm, Conficker, Kraken, and Torpig [17], to achieve this purpose. A fast-flux network acquires a large number of proxies which redirect users' requests to the phishing websites. It is very difficult to perform a follow-up of the communications because the proxies change very quickly and they can take advantage of the short DNS TTL for the flux domain. It is of great importance for a fast-flux network owner to obtain a large number of proxies and heterogeneous locations of the proxies. Bots in a botnet act the role of proxies very well in a fast-flux network. This is why botnets can perform a hiding mechanism. For instance, the Storm botnet is able to hide code updating. The Honeynet Project [18] presents the first case that studied fast-flux networks, and this project describes several examples of fast-flux service networks. On this project's website, it gives a general introduction of fast-flux service networks, and tries to explain how they work and how criminals utilize them. FluXOR [19] was the first published system which was used to detect fast-flux networks. How FluXOR detects fast-flux networks depends on analyzing the observable characteristics by ordinary users. The authors of this paper proposed that three types of characteristics--domain name, availability of the network, and heterogeneity of the agents--can be used to differentiate between benign and malicious hostnames. [PERSON] et al. gave a definition to a metric which can be used to differentiate fast-flux networks from the legitimate content distribution networks [PERSON] et al. (2016). This metric takes advantage of two limitations of fast-flux networks: (i) the diverse range of IP addresses of a fast flux; and (ii) lacking of guaranteed uptime of the flux agent, so the controlled machines can collapse anytime. Later, the technology of data mining of live traffic was utilized by [PERSON] and [PERSON] to discover new fast-flux domains, and then they traced those botnets with proactive measurements [PERSON] and [PERSON] (2016). [PERSON] et al. proposed a behavioral analysis of fast-flux networks by using their database [PERSON] and [PERSON] (2016). The results indicate that such networks share common life-cycle features and form clusters, which are based on the size, growth, and the type of vicious behavior. In addition, [PERSON] et al. came up with a study of an empirical method for checking and classifying fast-flux service networks immediately [PERSON] et al. (2016). A passive approach for detecting and tracking malicious flux service networks was raised by [PERSON] et al. [PERSON] et al. (2017). Their detection system is based on the passive analysis of recursive DNS traffic gathered from multiple large-sized networks. It is capable of detecting raw malicious flux service networks rather taking them from spam mails or domain blacklists. It is worth mentioning that [PERSON] et al. present EXPOSURE, a system that utilizes massive and passive DNS analysis techniques to examine aggressive activity domains which are involved in [PERSON] et al. (2016).