Investigating the Agility Bias in DNS Graph Mining

Abstract

The concept of agile domain name system (DNS) refers to dynamic and rapidly changing mappings between domain names and their Internet protocol (IP) addresses. This empirical paper evaluates the bias from this kind of agility for DNS-based graph theoretical data mining applications. By building on two conventional metrics for observing malicious DNS agility, the agility bias is observed by comparing bipartite DNS graphs to different subgraphs from which vertices and edges are removed according to two criteria. According to an empirical experiment with two longitudinal DNS datasets, irrespective of the criterion, the agility bias is observed to be severe particularly regarding the effect of outlying domains hosted and delivered via content delivery networks and cloud computing services. With these observations, the paper contributes to the research domains of cyber security and DNS mining. In a larger context of applied graph mining, the paper further elaborates the practical concerns related to the learning of large and dynamic bipartite graphs.

An empirical survey on the early adoption of DNS certification authority authorization

“…By using a common undirected and bipartite DNS graph representation [31], there are two types of vertices: the domains sampled from the Alexa's list and the domains the sampled domains have authorized via the issue or the issuewild tags. Whenever a given "Alexa-domain" has authorized a "CA-domain", an edge is placed between these two types of domain vertices.…”

A case study on software vulnerability coordination

“…The structure is again undirected, unweighted, and bipartite: The network G s is a social network in the traditional sense; even though participants are linked to each other through abstract identifiers, the participants are still human beings. The network G d , in contrast, resembles more the so-called domain name system graphs within which domain names are connected to each other via Internet protocol (IP) addresses or by other technical relations [94,103]. Consequently, it would be possible to manipulate G d by resolving the addresses of the domain names or by considering only the second-level domain names [96].…”

Graph theory-based radial load flow analysis to solve the dynamic network reconfiguration problem

“…V is the vertex set of G, and E is the edge set. The vertices are said to be adjacent to each other if they are interconnected through an edge [39,40]. The example of nodes and edges is shown in Figure 4 using six-bus test system (shown previously in Figure 1).…”

“…(1) Arranging the From-To position: The edge that represents the line-data E (From-To) is sorted out to ensure that From < To in each element of line data. (2) Determining the number of descendants (NoD) of each node: The NoD of each node is determined based on the DFS order using Equation (40).…”