Intercepting Hail Hydra: Real-Time Detection of Algorithmically Generated Domains

Abstract

A crucial technical challenge for cybercriminals is to keep control over the potentially millions of infected devices that build up their botnets, without compromising the robustness of their attacks. A single, fixed C&C server, for example, can be trivially detected either by binary or traffic analysis and immediately sink-holed or taken-down by security researchers or law enforcement. Botnets often use Domain Generation Algorithms (DGAs), primarily to evade take-down mechanisms. DGAs enlarge the lifespan of a malware campaign, thus enhancing its profitability. They can also contribute to hardening attack attribution. In this work, we introduce HYDRA the most comprehensive and complete available dataset of Algorithmically-Generated Domains (AGD). The dataset contains more than 100 DGA families, including both real-world and adversarial ones. We analyse the dataset and discuss the possibility of differentiating between benign requests (to real domains) and malicious ones (to AGDs) in real-time. The simultaneous study of so many families and variants introduces several challenges; nonetheless, it alleviates biases found in previous literature that deals with small datasets and exploit some characteristic features of particular families. To this end, we thoroughly compare our approach with the current state-of-the-art and highlight some methodological shortcomings in the actual state of practice. The outcomes obtained show that our method significantly outperforms the current state-of-the-art in terms of both accuracy and efficiency.

Unearthing malicious campaigns and actors from the blockchain DNS ecosystem

“…As observed in the studied BDNS systems and due the possibility of having other potential indicators, we believe that exploring and assessing the different data managed by such systems is crucial to design the proper mitigation strategies. For example, parameters such as the amount of suspicious domains registered (e.g., domain squatting [56], or artificially generated domains [61]), the number of wallet updates, the IPs and domains registered, and the connectivity of the nodes are features that can be used to identify potentially harmful user behaviours. The latter can be augmented by our hop-based approach as well as similar methods following blacklisting policies, enhancing the reliability and trust of blockchain DNS while reducing the impact of malicious campaigns.…”