The DOI matches its Crossref record; 20 of the 20 references it cites were found in a registry or an index.
Detecting algorithmically generated malicious domain names
Open accessAbstract
Recent Botnets such as Conficker, Kraken and Torpig have used DNS based "domain fluxing" for command-and-control, where each Bot queries for existence of a series of domain names and the owner has to register only one such domain name. In this paper, we develop a methodology to detect such "domain fluxes" in DNS traffic by looking for patterns inherent to domain names that are generated algorithmically, in contrast to those generated by humans. In particular, we look at distribution of alphanumeric characters as well as bigrams in all domains that are mapped to the same set of IP-addresses. We present and compare the performance of several distance metrics, including KL-distance, Edit distance and Jaccard measure. We train by using a good data set of domains obtained via a crawl of domains mapped to all IPv4 address space and modeling bad data sets based on behaviors seen so far and expected. We also apply our methodology to packet traces collected at a Tier-1 ISP and show we can automatically detect domain fluxing as used by Conficker botnet with minimal false positives.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Elements of Information Theory
Cover, T. M., & Thomas, J. A. (2001) · Wiley eBooks · doi:10.1002/0471200611 · Cited by 36,808
Elements of Information Theory
Cover, T. M., & Thomas, J. A. (2005) · doi:10.1002/047174882x · Cited by 13,791
Detection, Estimation, And Modulation Theory
Trees, H. L. V. (1968) · Cited by 5,969
Gu, G., Roberto Perdisci, A., Zhang, J., & Lee, W. (2008) · Journal of Bioresource Management · Cited by 1,033
Beyond blacklists: learning to detect malicious web sites from suspicious URLs
Ma, J., Saul, L. K., Savage, S., & Voelker, G. M. (2009) · Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining · doi:10.1145/1557019.1557153 · Cited by 803
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic
Gu, G., Zhang, J., & Lee, W. (2008) · CORE Scholar (Wright State University) · Cited by 702
Your botnet is my botnet: analysis of a botnet takeover
Stone-Gross, B., Cova, M., Cavallaro, L., Gilbert, B., Szydlowski, M., Kemmerer, R., Kruegel, C., & Vigna, G. (2009) · Proceedings of the 16th ACM conference on Computer and communications security · doi:10.1145/1653662.1653738 · Cited by 577
Trees, H. L. V. (1992) · Cited by 511
Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm
Holz, T., Steiner, M., Dahl, F., Biersack, E. W., & Freiling, F. (2008) · Cited by 383
Spamming botnets: signatures and characteristics
Xie, Y., Yu, F., Achan, K., Panigrahy, R., Hulten, G., & Osipkov, I. (2008) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1402946.1402979 · Cited by 339
Cited by
Botnet in DDoS Attacks: Trends and Challenges
Hoque, N., Bhattacharyya, D. K., & Kalita, J. K. (2015) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2457491 · Cited by 299
Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295
PhishStorm: Detecting Phishing With Streaming Analytics
Marchal, S., Francois, J., State, R., & Engel, T. (2014) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2014.2377295 · Cited by 271
Metadata
- Authors
- Yadav, S., Reddy, A. K. K., Reddy, A. L. N., & Ranjan, S.
- Venue
- Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
- Publisher
- ACM
- Published
- 2010-11
- Pages
- 48-61
- OpenAlex
- W2136495567
- Cited by
- 355
- References
- 20
- FWCI
- 15.03
- Type
- conference paper
- Language
- en
- Open access
- green
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Detecting algorithmically generated malicious domain names. https://app.cochat.ai/papers/10.1145/1879141.1879148
- The paper
- Yadav, S., Reddy, A. K. K., Reddy, A. L. N., & Ranjan, S. (2010). Detecting algorithmically generated malicious domain names. Proceedings of the 10th ACM SIGCOMM conference on Internet measurement. https://doi.org/10.1145/1879141.1879148
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
