Monitoring the initial DNS behavior of malicious domains

Abstract

Attackers often use URLs to advertise scams or propagate malware. Because the reputation of a domain can be used to identify malicious behavior, miscreants often register these domains "just in time" before an attack. This paper explores the DNS behavior of attack domains, as identified by appearance in a spam trap, shortly after the domains were registered. We explore the behavioral properties of these domains from two perspectives: (1) the DNS infrastructure associated with the domain, as is observable from the resource records; and (2) the DNS lookup patterns from networks who are looking up the domains initially. Our analysis yields many findings that may ultimately be useful for early detection of malicious domains. By monitoring the infrastructure for these malicious domains, we find that about 55% of scam domains occur in attacks at least one day after registration, suggesting the potential for early discovery of malicious domains, solely based on properties of the DNS infrastructure that resolves those domains. We also find that there are a few regions of IP address space that host name servers and other types of servers for only malicious domains. Malicious domains have resource records that are distributed more widely across IP address space, and they are more quickly looked up by a variety of different networks. We also identify a set of "tainted" ASes that are used heavily by bad domains to host resource records. The features we observe are often evident before any attack even takes place; ultimately, they might serve as the basis for a DNS-based early warning system for attacks.

Detecting Malicious Domains and Authoritative Name Servers Based on Their Distinct Mappings to IP Addresses

“…We understand that previous work [3] investigates on initial DNS behaviors (e.g. registration of domains) of malicious domains and reports some interesting characteristics but does not propose a method to detect malicious domains.…”

“…Hao et al [3] studied behavior of spam domains combining with active DNS behavior and registration information. Although they found that IP spaces used by spam domains were small, how d, ns-d and IP were related was not studied.…”

“…The contribution of the proposed method is two-fold: (1) it can detect unknown malicious domains, name servers' domains, and their corresponding IP addresses that are not in existing blacklists, (2) it uses data that is publicly accessible and easy to obtain by a single DNS resolver while the existing methods rely on additional data that is available for certain entities such as a long period of historical data of domains and IPs [1], DNS traffic captured at large networks such as ISP [2], and DNS responses obtained by a large number of resolvers in different locations (continents) [3].…”

“…Comparing with [1], [2], [4], the main advantage of proposed method is that it can be realized with low requirements for necessary data. Namely, our method uses data that is publicly accessible and easy to obtain by a single DNS resolver while the other existing methods rely on additional data that are available for only certain privileged entities such as a long period of historical data of domains and IPs [1], DNS traffic captured at large networks such as ISP [2], and DNS responses obtained by large number of resolvers in different locations (continents) [3].…”

Proactive Discovery of Phishing Related Domain Names

“…Due to their short lifetime, the early identification of phishing websites is paramount, as a result several methods have been proposed to avoid reactive blacklisting and develop more proactive methods. In [10], Hao et al analyze early DNS behavior of newly registered domains. It is demonstrated that they are characterized by DNS infrastructure pattern and DNS lookup patterns monitored as soon as they are registered, such as either a wide scattering of resource records across the IP address space in only few regions, or resource records that are often hosted in tainted autonomous systems.…”