Proactive detection of algorithmically generated malicious domains

Spaulding, Jeffrey; Park, Jeman; Kim, Joongheon; Mohaisen, Aziz

doi:10.1109/icoin.2018.8343077

Cited by 11 publications

(6 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Domain Generation Algorithms (DGAs) are utilized to intermittently produce a large number of domain names for malicious purposes. There exist several research works that explored the ecosystem of DGAs [59,60,61,28,12,62].…”

Section: Dns Threat Landscapementioning

confidence: 99%

“…For example, Figure 7 shows an overview of the communication of malware-infected hosts with C&C servers. There exist several research works that explored the ecosystem of DGAs [59,60,61,28,12,62].…”

Section: Domain Generation Algorithmmentioning

confidence: 99%

“…Spaulding et al [62] have presented a malicious domain detection system that proactively detects algorithmically generated domain names. Their work highlighted the difference between the number of NXDomain responses of benign and algorithmically generated domain names prior to registration.…”

Section: Domain Generation Algorithmmentioning

confidence: 99%

“…Figure8: A sample DGA code that is utilized to intermittently generate large number of algorithmic domain names, mainly for malicious purposes[62].…”

mentioning

confidence: 99%

See 3 more Smart Citations

Domain Name System Security and Privacy: A Contemporary Survey

Khormali¹,

Park²,

Alasmary³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

The domain name system (DNS) is one of the most important components of today's Internet, and is the standard naming convention between human-readable domain names and machine-routable IP addresses of Internet resources. However, due to the vulnerability of DNS to various threats, its security and functionality have been continuously challenged over the course of time. Although, researchers have addressed various aspects of the DNS in the literature, there are still many challenges yet to be addressed. In order to comprehensively understand the root causes of the vulnerabilities of DNS, it is mandatory to review the various activities in the research community on DNS landscape. To this end, this paper surveys more than 170 peer reviewed papers, which are published in both top conferences and journals in last ten years, and summarizes vulnerabilities in DNS and corresponding countermeasures. This paper not only focuses on the DNS threat landscape and existing challenges, but also discusses the utilized data analysis methods, which are frequently used to address DNS threat vulnerabilities. Furthermore, we looked into the DNS threat landscape from the view point of the involved entities in the DNS infrastructure in an attempt to point out more vulnerable entities in the system.

show abstract

Section: Dns Threat Landscapementioning

confidence: 99%

Section: Domain Generation Algorithmmentioning

confidence: 99%

Section: Domain Generation Algorithmmentioning

confidence: 99%

“…Figure8: A sample DGA code that is utilized to intermittently generate large number of algorithmic domain names, mainly for malicious purposes[62].…”

mentioning

confidence: 99%

See 2 more Smart Citations

Domain Name System Security and Privacy: A Contemporary Survey

Khormali¹,

Park²,

Alasmary³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Related to our use of network features is a line of research on traffic analysis for malware and botnet detection. Such works include [39][40][41][42][43][44], with others paying particular attention to the use of fast-flux techniques [45][46][47][48][49][50]. Support for our use of DNS features for malware analysis comes in [51][52][53].…”

Section: Related Workmentioning

confidence: 99%

Network-based Analysis and Classiﬁcation of Malware using Behavioral Artifacts Ordering

Mohaisen¹,

Alrawi²,

Park³

et al. 2018

ICST Transactions on Security and Safety

Self Cite

View full text Add to dashboard Cite

Using runtime execution artifacts to identify malware and its associated "family" is an established technique in the security domain. Many papers in the literature rely on explicit features derived from network, file system, or registry interaction. While effective, the use of these fine-granularity data points makes these techniques computationally expensive. Moreover, the signatures and heuristics are often circumvented by subsequent malware authors. In this work, we propose Chatter, a system that is concerned only with the order in which high-level system events take place. Individual events are mapped onto an alphabet and execution traces are captured via terse concatenations of those letters. Then, leveraging an analyst labeled corpus of malware, n-gram document classification techniques are applied to produce a classifier predicting malware family. This paper describes that technique and its proof-of-concept evaluation. In its prototype form only network events are considered and eleven malware families are used. We show the technique achieves 83%-94% accuracy in isolation and makes non-trivial performance improvements when integrated with a baseline classifier of combined order features to reach an accuracy of up to 98.8%.

show abstract

Domain-Checker: A Classification of Malicious and Benign Domains Using Multitier Filtering

Bhadauria,

Singh

2023

SN COMPUT. SCI.

View full text Add to dashboard Cite

Proactive detection of algorithmically generated malicious domains

Cited by 11 publications

References 12 publications

Domain Name System Security and Privacy: A Contemporary Survey

Domain Name System Security and Privacy: A Contemporary Survey

Network-based Analysis and Classiﬁcation of Malware using Behavioral Artifacts Ordering

Domain-Checker: A Classification of Malicious and Benign Domains Using Multitier Filtering

Contact Info

Product

Resources

About