Mobile devices have widespread to become the most used piece of technology.
Due to their characteristics, they have become major targets for botnet-related
malware. FluBot is one example of botnet malware that infects mobile devices.
In particular, FluBot is a DNS-based botnet that uses Domain Generation
Algorithms (DGA) to establish communication with the Command and Control Server
(C2). MONDEO is a multistage mechanism with a flexible design to detect
DNS-based botnet malware. MONDEO is lightweight and can be deployed without
requiring the deployment of software, agents, or configuration in mobile
devices, allowing easy integration in core networks. MONDEO comprises four
detection stages: Blacklisting/Whitelisting, Query rate analysis, DGA analysis,
and Machine learning evaluation. It was created with the goal of processing
streams of packets to identify attacks with high efficiency, in the distinct
phases. MONDEO was tested against several datasets to measure its efficiency
and performance, being able to achieve high performance with RandomForest
classifiers. The implementation is available at github.

手机设备、僵尸网络恶意软件、FluBot、基于 DNS 的僵尸网络和 MONDEO 是该研究论文的关键词。MONDEO 是一个多阶段的机制，具有灵活的设计，用于检测基于 DNS 的僵尸网络恶意软件，通过黑名单 / 白名单、查询速率分析、异域感应和机器学习评估等四个检测阶段实现高效识别攻击。