Wednesday, July 16. 2008
Back in February, we published a paper on
fast-flux service networks at
NDSS'08. The basic idea behind fast-flux networks is a fast change in the mapping between a domain name and the corresponding IP addresses. The attackers use this mechanism to build a proxy-network on top of compromised machines to maintain a robust hosting infrastructure for their services. For more information on this topic, see the paper by the
Honeynet Project or our
NDSS paper.
To foster research in this area, the data collected during our study is available for research purposes. Up to now, quite a few people mailed me and asked for the data. To make this process a bit more scalable and also minimize the amount of work needed at my side, we decided to simply publish all the data such that everyone can download the raw data and use it for whatever purpose. Today, I uploaded a
tarball which contains a summary of the fast-flux data collected over a period of several weeks. The tarball contains a potpourri of different measurements and has a total size of 7.3 MB. It contains about 55K raw
dig lookup files and has an unpacked size of about 220 MB. The archive contains the following data:
- storm-qavoter.com.log: dig lookups for domain used by the Storm Worm botnet which uses fast-flux techniques
- asprox-damnec-hydra.log: dig lookups for Asprox/Damnec botnet which also uses fast-flux techniques
- lookups-ff: dig lookups for fast-flux domains, confirmed manually
- lookups-spam: dig lookups for various domains found in spam e-mails
- lookups-benign: dig lookups for (probable) benign domains, most of them collected via dmoz or Alexa
- lookups-ndss: part of the domains used for the NDSS paper
- lookups-ndss-ff: suspected fast-flux domains from NDSS paper
So if you are interested in this area and want to learn more about it, just download the
archive (7.3 MB) and play with the files :)
".
