Updating headings on every page

content/posts/fast-flux-botnet-overview.md

@@ -4,15 +4,15 @@ date: 2019-09-26
 draft: false
 ---
 
-# Introduction
+## Introduction
 
 In this post we will explore a brief overview of the fast-flux (FF) technique used by botnets. [Here is my full paper](/security/FastFluxPaper.pdf) with more detail regarding what a botnet is and how FF works.
 
-# Botnet Overview
+## Botnet Overview
 
 Botnets  are  a  major  threat  to  all  those  connected  to  the  Internet.   They are used for distributing spam, hosts for malicious code, sending phishing attacks, and performing a variety of attacks, including denial of service (DOS). Many botnets will use DNS names to control or connect to the botnet. This would seemingly be easy to shutdown, just block the particular domain, however through a technique called fast-flux (FF), botnets are able to evade detection and mitigation.
 
-# Fast Flux Overview
+## Fast Flux Overview
 
 Fast-flux is the process of quickly changing the domain name or IP addresses associated with a domain in order to hide the bot-master, or  command and control (CC), for the botnet. These fast changes are accomplished through two primary technologies, dynamic DNS (DynDNS) and round robin.
 
@@ -24,11 +24,11 @@ Round robin was a technique developed for load balancing. Sites that see a large
 
 In addition to DynDNS and round-robin, some botnets will be double-fluxed. In this technique a botnet will setup its own name servers and rotate through them as well. More detail is in the paper.
 
-# Detection/Mitigation
+## Detection/Mitigation
 
 There are two primary ways of detecting and mitigating fast-fluxing botnets that need to be used in conjunction. The first is to look at the time to live (TTL) for DNS entries to be cashed. Fast-fluxing botnets tend to use very short TTL values compared to legitimate domains. The second is keeping a "FF Activity Index" or how often name-address relationships change. The "FF Activity Index" will hold both how often the IP address for a given domain changes and how often domains change for a single IP address. Even looking at these two indicators still yields a number of false positives. More details in the paper.
 
-# Conclusion
+## Conclusion
 
 Botnets are getting more sophisticated and more research is needed to detect these techniques. The best way to block these connections is to attempt to stop the CC directly. Most hide behind proxies and many use FF techniques to hide those. FF is an arms race between detection and ever more sophisticated ways of hiding activities.