There are several types of takedowns to disrupt malware operations. If the malware uses domain names to look up and to communicate with centralized C&C servers. What is the line of action in the above scenario? As the botmaster has little control of the IP address diversity and down-time for compromised machines in a fast-flux network, we can use these features to detect fast-flux

Database System Concepts
7th Edition
ISBN:9780078022159
Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Chapter1: Introduction
Section: Chapter Questions
Problem 1PE
icon
Related questions
Question

Cyber Security answers please

There are several types of takedowns to disrupt
malware operations. If the malware uses domain
names to look up and to communicate with
centralized C&C servers.
What is the line of action in the above scenario?
As the botmaster has little control of the IP address diversity and down-time for compromised
machines in a fast-flux network, we can use these features to detect fast-flux
Among the algorithm-generated domains, the botmaster can pick a few to register (e.g., daily,
and make them resolve to the C&C servers
we can partition the P2P botnet into isolated sub-networks, create a sinkhole node, or poison
the communication channel by issuing commands to stop the malicious activities
we perform takedown of C&C domains by 'sinkhole' the domains, i.e., making the C&C
domains resolve to the defender's servers so that botnet traffic is 'trapped' (that is, redirected)
to these servers
DI:
Transcribed Image Text:There are several types of takedowns to disrupt malware operations. If the malware uses domain names to look up and to communicate with centralized C&C servers. What is the line of action in the above scenario? As the botmaster has little control of the IP address diversity and down-time for compromised machines in a fast-flux network, we can use these features to detect fast-flux Among the algorithm-generated domains, the botmaster can pick a few to register (e.g., daily, and make them resolve to the C&C servers we can partition the P2P botnet into isolated sub-networks, create a sinkhole node, or poison the communication channel by issuing commands to stop the malicious activities we perform takedown of C&C domains by 'sinkhole' the domains, i.e., making the C&C domains resolve to the defender's servers so that botnet traffic is 'trapped' (that is, redirected) to these servers DI:
Expert Solution
trending now

Trending now

This is a popular solution!

steps

Step by step

Solved in 2 steps

Blurred answer
Knowledge Booster
Windows
Learn more about
Need a deep-dive on the concept behind this application? Look no further. Learn more about this topic, computer-science and related others by exploring similar questions and additional content below.
Recommended textbooks for you
Database System Concepts
Database System Concepts
Computer Science
ISBN:
9780078022159
Author:
Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan
Publisher:
McGraw-Hill Education
Starting Out with Python (4th Edition)
Starting Out with Python (4th Edition)
Computer Science
ISBN:
9780134444321
Author:
Tony Gaddis
Publisher:
PEARSON
Digital Fundamentals (11th Edition)
Digital Fundamentals (11th Edition)
Computer Science
ISBN:
9780132737968
Author:
Thomas L. Floyd
Publisher:
PEARSON
C How to Program (8th Edition)
C How to Program (8th Edition)
Computer Science
ISBN:
9780133976892
Author:
Paul J. Deitel, Harvey Deitel
Publisher:
PEARSON
Database Systems: Design, Implementation, & Manag…
Database Systems: Design, Implementation, & Manag…
Computer Science
ISBN:
9781337627900
Author:
Carlos Coronel, Steven Morris
Publisher:
Cengage Learning
Programmable Logic Controllers
Programmable Logic Controllers
Computer Science
ISBN:
9780073373843
Author:
Frank D. Petruzella
Publisher:
McGraw-Hill Education