YoVDO

New Trends in FastFlux Networks

Offered By: Black Hat via YouTube

Tags

Black Hat Courses Cybersecurity Courses Network Security Courses Malware Analysis Courses Threat Detection Courses

Course Description

Overview

Explore new trends in fast-flux networks as revealed by tracking and analyzing over 200 fast-flux domains. Discover how attackers have adapted their techniques, including slower IP address and name server change rates, sharing of resources among different malware families, and the emergence of "n-level" flux behavior. Learn about the underground economic model supporting fast-flux networks and compare these malicious techniques with benign applications using similar methods. Examine proposed detection approaches based on these new characteristics and gain insights into the evolving landscape of fast-flux domain usage in cybersecurity.

Syllabus

Intro
What we used to know
Slower Change Rate
Why Slower?
Sharing of IP and Name Servers
Why Sharing?
Two levels of sharing
Inter-malware-family IP sharing
One IP at A Time
Clustering
How the domains are connected
Inter-cluster connections
What can we learn from cluster?
What looks like Fast-Flux, but NOT
Characteristics of benign Fast-Flux
How do we collect the data?
What About Defense?


Taught by

Black Hat

Related Courses

Malicious Software and its Underground Economy: Two Sides to Every Story
University of London International Programmes via Coursera Palo Alto Networks Cybersecurity Essentials II
Palo Alto Networks via Coursera Introducción al Análisis del Malware en Windows
National Technological University – Buenos Aires Regional Faculty via Miríadax Android Malware Analysis - From Zero to Hero
Udemy How to Create and Embed Malware (2-in-1 Course)
Udemy