Behavioral Analysis and Visualization of Fast-Flux DNS

Today, a growing, sophisticated technique called Fast-Flux Service Networks (FFSN) poses a major problem to Internet security. They are increasingly used in many illegal practices including money mule recruitment sites, distribution of malware downloads, illegal adult content, and other forms of Internet fraud. Essentially, FFSN were first used as a Domain Name Server (DNS) switching mechanism that combine distributed command and control, web-based load balancing, and proxy redirection. However, cyber criminals are applying various techniques to subvert detection, retain uptime of their information infrastructure and maximize their financial gain. Hence, this paper proposed to analyze and visualize the behavior of FFSN in order to facilitate FFSN detection. In this study, we collect, classify and monitor over500 domains and by scrutinizing and visualizing the trained data, we discover the new types of fluxing designated as NSName-Flux(NF). The analysis results of NF exposed that FFSN have become extensively sophisticated and dynamic. This exemplifies that visualization is an alternative and effective data exploration method for understanding the complex behaviors of FFSN.