New Trends in FastFlux Networks
Offered By: Black Hat via YouTube
Course Description
Overview
Explore new trends in fast-flux networks as revealed by tracking and analyzing over 200 fast-flux domains. Discover how attackers have adapted their techniques, including slower IP address and name server change rates, sharing of resources among different malware families, and the emergence of "n-level" flux behavior. Learn about the underground economic model supporting fast-flux networks and compare these malicious techniques with benign applications using similar methods. Examine proposed detection approaches based on these new characteristics and gain insights into the evolving landscape of fast-flux domain usage in cybersecurity.
Syllabus
Intro
What we used to know
Slower Change Rate
Why Slower?
Sharing of IP and Name Servers
Why Sharing?
Two levels of sharing
Inter-malware-family IP sharing
One IP at A Time
Clustering
How the domains are connected
Inter-cluster connections
What can we learn from cluster?
What looks like Fast-Flux, but NOT
Characteristics of benign Fast-Flux
How do we collect the data?
What About Defense?
Taught by
Black Hat
Related Courses
Computer SecurityStanford University via Coursera Cryptography II
Stanford University via Coursera Malicious Software and its Underground Economy: Two Sides to Every Story
University of London International Programmes via Coursera Building an Information Risk Management Toolkit
University of Washington via Coursera Introduction to Cybersecurity
National Cybersecurity Institute at Excelsior College via Canvas Network