Efficient and Accurate Behavior-Based Tracking of Malware-Control Domains in Large ISP Networks

Abstract

In this article, we propose Segugio , a novel defense system that allows for efficiently tracking the occurrence of new malware-control domain names in very large ISP networks. Segugio passively monitors the DNS traffic to build a machine-domain bipartite graph representing who is querying what . After labeling nodes in this query behavior graph that are known to be either benign or malware-related, we propose a novel approach to accurately detect previously unknown malware-control domains. We implemented a proof-of-concept version of Segugio and deployed it in large ISP networks that serve millions of users. Our experimental results show that Segugio can track the occurrence of new malware-control domains with up to 94% true positives (TPs) at less than 0.1% false positives (FPs). In addition, we provide the following results: (1) we show that Segugio can also detect control domains related to new, previously unseen malware families, with 85% TPs at 0.1% FPs; (2) Segugio’s detection models learned on traffic from a given ISP network can be deployed into a different ISP network and still achieve very high detection accuracy; (3) new malware-control domains can be detected days or even weeks before they appear in a large commercial domain-name blacklist; (4) Segugio can be used to detect previously unknown malware-infected machines in ISP networks; and (5) we show that Segugio clearly outperforms domain-reputation systems based on Belief Propagation.

Clustering Malicious DNS Queries for Blacklist-Based Detection

“…The numbers of malicious queries classified into clus- ters (1), (2), and (3) in Fig. 2 (c) were 1, 375, and 12, respectively.…”

“…In cluster (2), queries related to domain reputation frequently occurred before and after the malicious queries, for example, to spamhaus.org, abuseat.org, and barracudacentral.org. Accordingly, we believe that the malicious queries in cluster (2) were caused by misdetection of communications from some security appliances. In cluster (3), queries to BitTorrent tracking sites occurred before and after the malicious queries, for example, to opentrackr.org, asnet.pw, and blackunicorn.…”

“…One common way to detect infected machines in a network is by monitoring communications based on blacklists. To improve the detection capability, several studies have attempted to automatically update blacklist entries by using machine learning techniques [2]. However, such detection is problematic because (1) no blacklist is completely reliable, and (2) blacklists do not provide the sufficient evidence to allow administrators to determine the validity and accuracy of the detection results.…”

A Superficial Analysis Approach for Identifying Malicious Domain Names Generated by DGA Malware

“…Rahbarinia et al [22] developed a system called Segugio that finds unknown malicious domains based on their cooccurrence relation with known malicious domains in DNS queries. Segugio is based on the following insights: (1) infected machines in the same malware family tend to communicate with the same malicious domain group and (2) uninfected machines have no reason to communicate with malicious domains.…”

“…Consequently, these results suggest the proposed approach achieves a high level of effectiveness for datasets collected via campus networks. Table IX presents a qualitative comparison of the proposed approach and the ten previously published methods, which are representative examples of blacklist-based detection [13], DPI-based detection [18], reputation-based detection [21], behavior-based detection [22], [23], [24], ML-based detection [27], and DL-based detection [28], [29], [30]. In this comparison, we focus on the following five items: (1) DGA malware detection performance, (2) the ability to detect malware in real time, (3) robustness to encryption, (4) dependence on network scale, and (5) the need for training in advance using datasets or other prior knowledge.…”