Shared by 
Unlock all 19 pages
Get it free by sharing your own notes, buy just this one, or become a member and unlock documents with your plan.
How to unlock this document
Choose the way that suits you. Each one gives you all 19 pages to read online and the PDF to download.
Share your notes, unlock for free
2 free unlocks for every 5 approved uploads
- Upload your own lecture notes, assignments, essays or past papers
- PDF, Word, PowerPoint and Excel files all work, and you can send many at once
- We check each upload; you get a notification when it is approved
- Spend a free unlock on this document or any other, and keep it for good
- Shared under your public username, never your email
Then upload your notes from your profile.
Buy this document
$19 one-time payment
- All 19 pages of this document, yours to keep
- Download the PDF and read it any time, also offline
- No subscription and nothing to cancel
- Find it again any time under My Profile → Library
You log in or create a free account first, then pay securely.
Become a member
Unlock documents from the whole library, which keeps growing
- Choose any documents you like, up to your plan’s unlocks
- Documents you unlock stay yours, even if you cancel later
- Your unlocks start again with every renewal
- Secure checkout by Dodo Payments
You log in or create a free account first, then pay securely.
Compare the plansAlready a member, or bought this before? Log in to open it
About this document
- Pages
- 19 pages
- Price
- $19 one-time, yours to keep
- Membership
- Included in every plan
- Format
- Subject
- Computer Science, Cybersecurity, Telecommunications
This presentation discusses a method to detect bot processes by analyzing their DNS activities. It describes the experiments conducted and the results obtained, which can help in understanding how to identify botnets and improve detection techniques.
What's inside
- Overview of detecting bot processes based on DNS activity
- Explanation of RD-behavior and its significance
- Experiments conducted to test the detection method
- Results and analysis of the experiments
- Limitations and future work in bot detection
Who it is for: Students of Computer Science, Cybersecurity, and Telecommunications. (Postgraduate)
Share with classmates: WhatsApp Telegram X LinkedIn Facebook
Summary
DNS activities of bot processes are examined. Students learn about detecting bot processes by analyzing their DNS behavior.
Bots and DNS
Bots join botnets using IP addresses or domains. DNS activities help lower connection failure rates but can produce failed DNS results.
Reaction to DNS behavior
Expected and anomalous DNS response behaviors are described. Processes react differently to DNS results. Suspicious behaviors are highlighted.
Experiments with bot detection
Several experiments test the detection of bots and non-bot malware. Different processes are observed for their DNS activities. Commercial bot detectors are compared.
Detection enhancements
Whitelists and process-based DNS metrics are used to improve detection. The goal is to maximize DNS use for malware detection.
Key terms
- RD-behavior
- A process’s reaction to DNS response behavior.
- SRDB
- Anomalous or suspicious reaction to DNS behavior.
- Botnet
- A network of infected computers controlled by a botmaster.
- Reverse DNS (rDNS)
- A method to map an IP address to a domain name.
- P2, P4, P5, P6
- Paths of DNS activities observed in experiments.
Questions this document helps with
- How do bots use DNS activities to join botnets?
- What are the expected and anomalous DNS behaviors?
- How can DNS activities help in detecting malware?
Summary written with AI from the document's text.
Ask the AI Teacher
Ask any question about this document or your course, and get a clear explanation.
Log in to ask Create a free account
Free accounts can ask 5 questions a day.