PASSVM：一种高精度在线快速流量检测系统
PASSVM: A Highly Accurate Online Fast Flux Detection System
摘要：
快速流量服务网络（FFSN）被对手用来实现一个高弹性的技术，他们的恶意服务器，同时保持他们隐藏的直接存取。在这种技术中，大量的僵尸网络机器，被称为流量代理，作为代理来中继终端用户和恶意主机服务器之间的流量，该主机服务器由对手控制。已经提出了用于检测FFSN的各种机制。这种机制依赖于收集大量的DNS流量跟踪，并需要大量的时间来识别快速流量域。在本文中，我们提出了一种有效的基于人工智能的在线快速通量检测系统，该系统可以对快速通量域进行高度准确和非常快速的检测。所提出的系统，称为PASSVM，是基于与给定的域名的DNS响应消息相关联的功能。该方法依赖于存储在两个本地数据库中的特征，以及从响应DNS消息本身提取的特征。数据库中的信息来自Censys搜索引擎和IP地理定位服务。PASSVM的评估使用三种类型的人工神经网络，它们是：多层感知器（MLP），径向基函数网络（RBF），和支持向量机（SVM）。实验结果表明，基于RBF核的SVM方法的检测准确率为99.557%，检测时间小于18 ms，优于其他两种方法。
英文摘要：
Fast Flux service networks (FFSNs) are used by adversaries to achieve a high resilient technique for their malicious servers while keeping them hidden from direct access. In this technique, a large number of botnet machines, that are known as flux agents, work as proxies to relay the traffic between end users and a malicious mothership server which is controlled by an adversary. Various mechanisms have been proposed for detecting FFSNs. Such mechanisms depend on collecting a large amount of DNS traffic traces and require a considerable amount of time to identify fast flux domains. In this paper, we propose an efficient AI-based online fast flux detection system that performs highly accurate and extremely fast detection of fast flux domains. The proposed system, called PASSVM, is based on features that are associated with DNS response messages of a given domain name. The approach relies on features that are stored in two local databases, in addition to features that are extracted from the response DNS messages itself. The information in the databases are obtained from Censys search engine and IP Geolocation service. PASSVM is evaluated using three types of artificial neural networks which are: Multilayer Perceptron (MLP), Radial Basis Function Network (RBF), and Support Vector Machines (SVM). Results show that SVM with RBF kernel outperformed the other two methods with an accuracy of 99.557% and a detection time of less than 18 ms.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
