Botconf 2013
ID: a1b9a683-2cda-5c89-bf2d-1c943c5bd798
STIX ID: report--a1b9a683-2cda-5c89-bf2d-1c943c5bd798
Feed Name: SensePost Blog
This post recaps a Botconf 2013 talk on detecting Fast-Flux botnet C2 domains using spatial dispersion statistics (Moran’s I and Geary’s C) combined with DNS features like TTL, A record counts, and ASN diversity. The approach reportedly achieved up to 97% accuracy with low false positives and minimal network impact, and includes references to a paper, presentation, and scripts for further review.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.