On the ground truth problem of malicious DNS traffic analysis

Stevanovic, Matija; Pedersen, Jens Myrup; D’Alconzo, Alessandro; Ruehrup, Stefan; Berger, Andreas

doi:10.1016/j.cose.2015.09.004

“…The advantage of our collaboration with law enforcement is that we can use their manual classification of benign and malicious domains from the takedown as a trustworthy source of ground truth. Previous studies mostly rely on publicly available blacklists and whitelists as the labeled ground truth [89], but malware blacklists have been found to contain benign parked or sinkholed domains and are ineffective at fully covering domains of several malware families [54], while lists of popular domains commonly used as whitelists can easily be manipulated by malware providers [56].…”

Section: Ground Truth Datamentioning

confidence: 99%

A Practical Approach for Taking Down Avalanche Botnets Under Real-World Constraints

Pochat¹,

hamme²,

Maroofi³

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

“…Criminal activities involving Advanced Persistent Threats (APT), malware and botnets use DNS service to locate Command and Control (C&C) servers for file transfer and updates [16], [34]. Spammers also rely on DNS service to redirect users to scams and phishing websites [35]. Zhao et al [47] explains that these cyber-criminal activities are often successful because DNS traffic is usually unfiltered or allowed through a firewall thereby providing a stealthy and undisturbed communication channel for cyber-criminals to operate.…”

Section: Introductionmentioning

confidence: 99%

“…Zhao et al also state that, DDNS provide the capability for cyber-criminals to maintain persistent presence on a victim's machine once it has been compromised as they can easily change their IP and domain information [47]. Stevanovic et al [35] calls DDNS, "agile DNS" and argue that, this feature poses a serious challenge to internet security. Agile DNS uses dynamic hosting strategies in which domain names and IP addresses associated with a particular service change over time.…”

Section: Introductionmentioning

confidence: 99%

Detection of Algorithmically Generated Malicious Domain Using Frequency Analysis

Agyepong¹,

Buchanan²,

Jones³

2018

IJCSIT

0

View full text Add to dashboard Cite

Malicious use and exploitation of Dynamic Domain Name Services (DDNS) capabilities poses a serious threat to the information security of organisations and businesses. In recent times, many malware writers have relied on DDNS to maintain their Command and Control (C&C) network infrastructure to ensure a persistence presence on a compromised host. Amongst the various DDNS techniques, Domain Generation Algorithm (DGA) is often perceived as the most elusive and difficult to detect using traditional methods. This paper presents an approach for detecting DGA using frequency analysis of the character distribution and the weighted scores of the domain names. The approach's feasibility is demonstrated using a range of legitimate domains and a number of malicious algorithmically-generated domain names. When a weighted score of < 45 is applied to the Alexa one million list of domain names, only 15% of the domain names were treated as non-human generated.

show abstract

“…Zhao et al also state that, DDNS provide the capability for cyber-criminals to maintain persistent presence on a victim's machine once it has been compromised as they can easily change their IP and domain information [47]. Stevanovic et al [35] calls DDNS, "agile DNS" and argue that, this feature poses a serious challenge to internet security. Agile DNS uses dynamic hosting strategies in which domain names and IP addresses associated with a particular service change over time.…”

Section: Introductionmentioning

confidence: 99%

“…Criminal activities involving Advanced Persistent Threats (APT), malware and botnets use DNS service to locate Command and Control (C&C) servers for file transfer and updates [16], [34]. Spammers also rely on DNS service to redirect users to scams and phishing websites [35]. Zhao et al [47] explains that these cyber-criminal activities are often successful because DNS traffic is usually unfiltered or allowed through a firewall thereby providing a stealthy and undisturbed communication channel for cyber-criminals to operate.…”

Section: Introductionmentioning

confidence: 99%