Malicious Domain
142503691
Cracking the Wall of Confinement: Understanding and Analyzing Malicious Domain Take downs
Take down operations aim to disrupt cybercrime involving malicious domains. In the past decade, many successful take down operations have been reported, including those against the Conficker worm, and most recently, against VPNFilter. Although it plays an important role in fighting cybercrime, the domain take down procedure is still surprisingly opaque. There seems to be no in depth understanding about how the take down operation works and whether there is due diligence to ensure its security and reliability. In this paper, we report the first systematic study on domain takedown. Our study was made possible via a large collection of data, including various sinkhole feeds and blacklists, passive DNS data spanning six years, and historical WHOIS information. Over these datasets, we built a unique methodology that extensively used various reverse lookups and other data analysis techniques to address the challenges in identifying taken down domains, sinkhole operators, and take down durations. Applying the methodology on the data, we discovered over 620K takendown domains and conducted a longitudinal analysis on the take down process, thus facilitating a better understanding of the operation and its weaknesses. We found that more than 14% of domains taken down over the past ten months have been released back to the domain market and that some of the released domains have been repurchased by the malicious actor again before being captured and seized, either by the same or different sinkholes. In addition, we showed that the misconfiguration of DNS records corresponding to the sinkholed domains allowed us to hijack a domain that was seized by the FBI. Further, we found that expired sinkholes have caused the transfer of around 30K takendown domains whose traffic is now under the control of new owners.
NDSS
Eihal Alowaisheq Peng Wang Sumayah A Alrwais Xiaojing Liao Xiaofeng Wang Tasneem Alowaisheq Xianghang Mi Siyuan Tang Baojun Liu
208277819
Premadoma: an operational solution for DNS registries to prevent malicious domain registrations
DNS is one of the most essential components of the Internet, mapping domain names to the IP addresses behind almost every online service. Domain names are therefore also a fundamental tool for attackers to quickly locate and relocate their malicious activities on the Internet. In this paper, we design and evaluate Premadoma, a solution for DNS registries to predict malicious intent well before a domain name becomes operational. In contrast to blacklists, which only offer protection after some harm has already been done, this system can prevent domain names from being used before they can pose any threats. We advance the state of the art by leveraging recent insights into the ecosystem of malicious domain registrations, focusing explicitly on facilitators employed for bulk registration and similarity patterns in registrant information. We thoroughly evaluate the proposed prediction model's performance and adaptability on an 11 month testing set, and address complex and domain specific dataset challenges. Moreover, we have successfully deployed Premadoma in the production environment of the .eu ccTLD registry to detect and prevent malicious registrations, and have contributed to the take down of 58,966 registrations in 2018.
ACSAC
Jan Spooren Thomas Vissers Peter Janssen Wouter Joosen Lieven Desmet
75136586
Malicious Domain Names Detection Algorithm Based on N Gram
Malicious domain name attacks have become a serious issue for Internet security. In this study, a malicious domain names detection algorithm based on N Gram is proposed. The top 100,000 domain names in Alexa 2013 are used in the N Gram method. Each domain name excluding the top level domain is segmented into substrings according to its domain level with the lengths of 3, 4, 5, 6, and 7. The substring set of the 100,000 domain names is established, and the weight value of a substring is calculated according to its occurrence number in the substring set. To detect a malicious attack, the domain name is also segmented by the N Gram method and its reputation value is calculated based on the weight values of its substrings. Finally, the judgment of whether the domain name is malicious is made by thresholding. In the experiments on Alexa 2017 and Malware domain list, the proposed detection algorithm yielded an accuracy rate of 94.04% a false negative rate of 7.42% and a false positive rate of 6.14% The time complexity is lower than other popular malicious domain names detection algorithms.
J. Comput. Networks Commun.
Hong Zhao Zhaobin Chang Guangbin Bao Xiangyan Zeng
68055919
Detection of malicious domain names based on an improved hidden Markov model
The ability to detect malicious domain names is critical for protection against internet security, data theft, and other dangers. Current methods for recognising malicious domain names have demonstrated poor detection accuracy in dealing with massive data. This paper proposes a novel malicious domain name detection method based on an improved Hidden Markov Model (HMM) Firstly, by analysing various characteristics of good and evil domain names in DNS communication, we can use Spark fast extraction to distinguish their attributes; then, we can quickly classify unknown domain names accurately by using Baum Welch algorithm and Viterbi algorithm in Hidden Markov Model (BVHMM) to achieve the effective detection of malicious domain names; finally, to test our approach, we conducted a series of experiments, and the experimental results demonstrate that our model achieves good accuracy and recall rate as compared with other detection models.
Hengliang Tang Chengang Dong
218871415
Using Passive DNS to Detect Malicious Domain Name
With the prosperity of the Internet, the number of malicious domain name is enormous, and the scope and harm of the threats they create are increasing. Using traditional reputation systems and reverse engineering methods to detect malicious domain name cannot be real time, and the process of detecting malicious domain name is complicated and cumbersome. In order to make up for the deficiencies and maintain accuracy, this paper adopts machine learning method and uses passive DNS as the analytical data to construct a malicious domain name classification detection model. According to the access characteristics and character characteristics of domain name, we designed a complete feature analysis scheme and proposed a multi dimensional DGA domain name detection method. We also propose a pornographic domain name detection method based on word vector in combination with the Chinese network environment. Finally, we implement prototype systems for malicious domain name detection and achieve good results.
ICVISP
Zhouyu Bao Wenbo Wang Yuqing Lan
202539799
HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification
Domain name system (DNS) is a crucial part of the Internet, yet has been widely exploited by cyber attackers. Apart from making static methods like blacklists or sinkholes infeasible, some weasel attackers can even bypass detection systems with machine learning based classifiers. As a solution to this problem, we propose a robust domain detection system named HinDom. Instead of relying on manually selected features, HinDom models the DNS scene as a Heterogeneous Information Network (HIN) consist of clients, domains, IP addresses and their diverse relationships. Besides, the metapath based transductive classification method enables HinDom to detect malicious domains with only a small fraction of labeled samples. So far as we know, this is the first work to apply HIN in DNS analysis. We build a prototype of HinDom and evaluate it in CERNET2 and TUNET. The results reveal that HinDom is accurate, robust and can identify previously unknown malicious domains.
RAID
Xiaoqing Sun Mingkai Tong Jiahai Yang
199001803
Multi Confirmations and DNS Graph Mining for Malicious Domain Detection
The Internet criminals use domain name service (DNS) as cornerstone for variety of malicious activities. Typically, attackers register domains name to locate their C{ }C\ (command and control servers) for spam mails, ddos attacks, etc. There are thousands of cyber attacks happening every day and the number of those increase with exponential growth, which becomes an urgent matter for cyber security. To tackle this issue, several recent techniques have been proposed to identify malicious domains. Most of them use DNS data which contains much of global information cannot be controlled by attackers. Hence, using labeled domains to identify malicious domains relying on their association by analyzing history log is reasonable. Besides, the graph is usually used to present the relationship between objects and many powerful algorithms have been successfully implemented on graph in literature. So, a method with modified version of the Belief Propagation algorithm to detect malicious domains based on a graph of domains and hosts IPs were proposed in our previous paper. In addition, graph inference is also applied with many different methods with very impressive results. However, these methods cannot handle all domains on the graph because the domains blacklist does not cover all graph components. This can be considered a bottle neck of the methods proposed. To solve this problem, we propose a new method by extending the previous work. This paper proposes a new approach which employs the law of total probability based on relationship between domains and clients to calculate malicious score of domains. This paper not only uses new score to label for domain but also combines with the previous score. The scores from the two methods are combined via a weighted sum to arrive at a score for each domain. The study shows high performance in malicious domain prediction on test case with accuracy, precision and recall as: 97.6% 99.2% and 93.1% This technique can discover huge potential malicious domains by mining on small knowledge data (black and white list domain) with highly precision. It indicates that the proposal technique is strongly effective in detecting malicious domains.
Hau Tran Chuong Dang Hieu Huu Nguyen Phuong Vo Tu Vu
71140152
Detection of algorithmically generated malicious domain names using masked N grams
Abstract Malware detection is a challenge that has increased in complexity in the last few years. A widely adopted strategy is to detect malware by means of analyzing network traffic, capturing the communications with their command and control (C&C) servers. However, some malware families have shifted to a stealthier communication strategy, since anti malware companies maintain blacklists of known malicious locations. Instead of using static IP addresses or domain names, they algorithmically generate domain names that may host their C&C servers. Hence, blacklist approaches become ineffective since the number of domain names to block is large and varies from time to time. In this paper, we introduce a machine learning approach using Random Forest that relies on purely lexical features of the domain names to detect algorithmically generated domains. In particular, we propose using masked N grams, together with other statistics obtained from the domain name. Furthermore, we provide a dataset built for experimentation that contains regular and algorithmically generated domain names, coming from different malware families. We also classify these families according to their type of domain generation algorithm. Our findings show that masked N grams provide detection accuracy that is comparable to that of other existing techniques, but with much better performance.
Expert Syst. Appl.
Josephine Pudumai Selvi Ricardo J Rodriguez Emilio Soria-Olivas
4410270
Detecting malicious domain names using deep learning approaches at scale
J. Intell. Fuzzy Syst.
R Vinayakumar K P Soman Prabaharan Poornachandran
52881788
DomainChroma: Building actionable threat intelligence from malicious domain names
Abstract Since the 1980s, domain names and the domain name system (DNS) have been used and abused. Although legitimate Internet users rely on domain names as indispensable infrastructures for using the Internet, attackers use or abuse them as reliable, instantaneous, and distributed attack infrastructures. However, there is a lack of complete understanding of such domain name abuses and methods for coping with them. In this study, we designed and implemented a unified analysis system combining current defense solutions to build actionable threat intelligence from malicious domain names. The basic concept underlying our system is malicious domain name chromatography. Our analysis system can distinguish among mixtures of malicious domain names for websites. On the basis of this concept, we do not create a hodgepodge of current solutions but design separation of abused domain names and offer actionable threat intelligence or defense information by considering the characteristics of malicious domain names as well as the possible defense solutions and points of defense. Finally, we evaluated our analysis system and defense information output using a large real dataset to show the effectiveness and validity of our system.
Comput. Secur.
Daiki Chiba Mitsuaki Akiyama Takeshi Yagi Kunio Hato Tatsuya Mori Shigeki Goto