Detecting Malicious Domains and Authoritative Name Servers Based on Their Distinct Mappings to IP Addresses

Abstract

As Domain Name System (DNS) provides flexibility and robustness in communications of hosts on Internet, not only legitimate users but also attackers often take advantages of it. If we know how attackers are managing their malicious domains with authoritative name servers, there is a possibility to detect not only malicious domains but also malicious authoritative name servers. In this study, we present a novel method for detecting malicious "domains" (noted as d) and malicious "authoritative name servers" (noted as ns-d) based on their distinct mappings to "IP addresses" (noted as IP). Namely, we present three features to detect them; 1) Single ns-d is mapped to many IP, 2) Single IP is mapped to many ns-d, and 3) Single IP is mapped to both ns-d and d. We evaluate proposed method in terms of accuracy and coverage in detection of malicious d and ns-d. The evaluation shows that our detection method can achieve significantly low false positive rate in detecting both malicious d and ns-d without relying on any previous knowledge, such as blacklists or whitelists.

Detection of Phishing Websites Hosted in Name Server Flux Networks Using Machine Learning

“…In this section, we contrast our research with previous studies that propose approaches for detecting phishing NS flux hostnames. Only two such works, Kadir et al (2012); Pa et al (2015), were found, as explained Key aspects of the comparison are summed up in Table 12. The detection time is the primary distinction between our work and the other works.…”

“…According to studies by Salusky and Danford (2008); Konte et al (2009); Kadir et al (2012); Metcalf and Spring (2013); Pa et al (2015), some of the authoritative NSs registering RRs of malicious web services display a fluxing behaviour in which their IP addresses change quickly. This phenomenon is known as NS IP Flux (NSIF).…”

“…The study also identified various types of IP addresses to NS mappings. By monitoring A and NS records of 50,030 malicious and legitimate hostnames for 6 months, Pa et al (2015) proposed an IP address and hostname mapping technique to detect double flux hostnames. Three criteria were used to map the records as detection features.…”

“…2 An experimental approach to detect NSIFN the authoritative NSs' IP addresses for the monitored hosted websites was not presented malicious websites Investigated flux agents and identified their key characteristics Demonstrated how vulnerable machines are taken advantage of and enlisted to create NSIFNs. Suggested a number of methods for mitigating flux networks Konte et al (2009) Provided empirical data on the changes to malicious An experimental approach to detect NSIFN websites' A records, as well as the names and A records hosted websites was not presented of the websites' DNSs Examined and outlined different network behaviours, both of NSIFNs and non-NSIFNs, in relation to the types of malicious content they host Metcalf and Spring (2013) Provided empirical proof of the changing behaviour of An experimental methodology to detect the authoritative NSs' IP addresses for the monitored websites that are hosted in NSIFNs malicious websites was not proposed Kadir et al (2012) To predict malicious websites hosted in single and The amount of data used was small double-flux NSIFNs, an ML model was proposed (consisting of only 500 websites) Zero errors were produced by the model High detection time (3 months) Pa et al (2015) Proposed a method for detecting malicious websites High detection time (6 months) hosted in double-flux NSIFNs by mapping IP addresses to hostnames Used a sizable dataset Low error rates were achieved by the model…”

“…A few studies have proposed approaches for detecting malicious NS flux hostnames. For example, Kadir et al (2012); Pa et al (2015) tracked DNS-related traits of legitimate and malicious websites and their hosting networks for up to several months to find detection patterns. However, they are constrained by the following:…”