关键词: APT攻击, Fast-flux, 集成学习, DNS 僵尸网络

Abstract: APT attacks harm the existing network security and pose a major threat to the security of enterprise data. Hackers and criminals may use the bot-nets to prepare for their own attacks before APT attacks. Fast-flux is used by hackers and criminals to conceal themselves and improve the chances of bot-net generation. To detect APT attacks, we need to detect fast-flux bot-net domain names. There are many deficiencies in the existing detection methods, so it is urgent to study the detection methods of fast-flux bot-net. We investigated the research status at home and abroad, and found that the existing methods have the problem of false positives and low accuracy for CDN domain names. This paper presents two new features and designs an AdaBoosting-based method using DNS traffic to solve the above problems. After that, the above detection methods are verified by experiments. Experiments show that the characteristics and methods proposed in this paper can effectively reduce the false positives of CDN domain names and greatly improve the overall detection performance in the detection of fast-flux domain names.

Key words: APT attacks, Fast-flux, ensemble learning, DNS