Poster: A Low-cost Detection Scheme on Fast-flux Malware Distribution

Malware is one of the most severe crucial security threats on the Internet. Many malware authors frequently change their malware distribution domains and URLs to avoid IDS (Intrusion Detection Systems) detection, and URLs become invalid shortly, which we name the malware distribution phenomenon fast-flux. We proposed a scheme named LDSM which could be able to detect fast-flux malware distribution with low cost. We have deployed our detection scheme in an ISP of CSTNET (China Science and Technology Network) for a month, and the experimental results demonstrate that LDSM is able to accurately detect malware distribution with 89.57% true positives. LDSM also could detect unknown malware from traffic and provides an effective way to improve malware detection tools. Keywords—Fast-flux, Malware distribution, Malware detection.