Domain Name Generation Algorithms

Mgr. Deepak Kumar Vishwakarma

Master's thesis

Abstract:

Botnets pose a major threat to the information security of Organizations and in- dividuals. The communication between bots (infected hosts) and Command and Control (C2) server is essential to update malware binaries in bots and receive com- mands. The domain names for C2 servers can be coded in malware which makes it easy to recover it from malware binary using reverse engineering. Once C2 server is discovered the botnet can be neutralized by bringing down the botnet C2 server. To avoid such detections malware tend to use alternative approaches to reach bot- net C2 server. A number of malware families use domain generation algorithms (DGA) to find out possible botnet C2 server.

Abstract:

Botnets pose a major threat to the information security of Organizations and in- dividuals. The communication between bots (infected hosts) and Command and Control (C2) server is essential to update malware binaries in bots and receive com- mands. The domain names for C2 servers can be coded in malware which makes it easy to recover it from malware binary using reverse engineering. Once C2 server is discovered the botnet can be neutralized by bringing down the botnet C2 server. To avoid such detections malware tend to use alternative approaches to reach bot- net C2 server. A number of malware families use domain generation algorithms (DGA) to find out possible botnet C2 server.

Keywords

Malware, Botnet, Domain-fluxing, Domain-name generation algorithm, Markov model

Language used: English

Date on which the thesis was submitted / produced: 22. 5. 2017

Thesis defence

• Date of defence: 20. 6. 2017
• Supervisor: Ing. Mgr. et Mgr. Zdeněk Říha, Ph.D.
• Reader: prof. RNDr. Václav Matyáš, M.Sc.

Masaryk University

Faculty of Informatics

Master programme / field:
Informatics / Information Technology Security (eng.)