A Cause-Based Classification Approach for Malicious DNS Queries Detected Through Blacklists

Abstract

Some of the most serious security threats facing computer networks involve malware. To prevent this threat, administrators need to swiftly remove the infected machines from their networks. One common way to detect infected machines in a network is by monitoring communications based on blacklists. However, detection using this method has the following two problems: no blacklist is completely reliable, and blacklists do not provide sufficient evidence to allow administrators to determine the validity and accuracy of the detection results. Therefore, simply matching communications with blacklist entries is insufficient, and administrators should pursue their detection causes by investigating the communications themselves. In this paper, we propose an approach for classifying malicious DNS queries detected through blacklists by their causes. This approach is motivated by the following observation: a malware communication is divided into several transactions, each of which generates queries related to the malware; thus, surrounding queries that occur before and after a malicious query detected through blacklists help in estimating the cause of the malicious query. Our cause-based classification drastically reduces the number of malicious queries to be investigated because the investigation scope is limited to only representative queries in the classification results. In experiments, we have confirmed that our approach could group 388 malicious queries into 3 clusters, each consisting of queries with a common cause. These results indicate that administrators can briefly pursue all the causes by investigating only representative queries of each cluster, and thereby swiftly address the problem of infected machines in the network.

A Word-Level Analytical Approach for Identifying Malicious Domain Names Caused by Dictionary-Based DGA Malware

“…These scenarios have motivated focus on the resolution of domain names for the traditional DNSs, which are not encryption, as an information source for detecting malware. Through previous investigations [28], we have confirmed that the traces of malicious activities appear in queries for the traditional DNSs.…”

Using NetFlow to Measure the Impact of Deploying DNS-based Blacklists

“…Similarly, papers such as [13,16] focusing on using blacklists for spam filtering in mail servers are also considered complementary. [4] 2012 Zhang et al [23] 2013 Kührer et al [10] 2014 Foremski et al [7] 2014 Satoh et al [14] 2019 Spacek et al [17] 2019 Wilde et al [21] 2019 Li et al [11] 2019 Telenor Norway [19] 2020 Griffioen et al [8] 2020…”

ARBA: Anomaly and Reputation Based Approach for Detecting Infected IoT Devices

“…This approach can lead to a high false positive rate for some IoT hosts due to version updates which usually behave similarly to botnet behavior. A more recent work used blacklists to perform cause-based classification of malicious DNS queries [19].…”