TY - GEN
T1 - Domainprofiler
T2 - 46th IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2016
AU - Chiba, Daiki
AU - Yagi, Takeshi
AU - Akiyama, Mitsuaki
AU - Shibahara, Toshiki
AU - Yada, Takeshi
AU - Mori, Tatsuya
AU - Goto, Shigeki
N1 - Publisher Copyright:
© 2016 IEEE.
PY - 2016/9/29
Y1 - 2016/9/29
N2 - Cyber attackers abuse the domain name system (DNS) to mystify their attack ecosystems, they systematically generate a huge volume of distinct domain names to make it infeasible for blacklisting approaches to keep up with newly generated malicious domain names. As a solution to this problem, we propose a system for discovering malicious domain names that will likely be abused in future. The key idea with our system is to exploit temporal variation patterns (TVPs) of domain names. The TVPs of domain names include information about how and when a domain name has been listed in legitimate/popular and/or malicious domain name lists. On the basis of this idea, our system actively collects DNS logs, analyzes their TVPs, and predicts whether a given domain name will be used for malicious purposes. Our evaluation revealed that our system can predict malicious domain names 220 days beforehand with a true positive rate of 0.985.
AB - Cyber attackers abuse the domain name system (DNS) to mystify their attack ecosystems, they systematically generate a huge volume of distinct domain names to make it infeasible for blacklisting approaches to keep up with newly generated malicious domain names. As a solution to this problem, we propose a system for discovering malicious domain names that will likely be abused in future. The key idea with our system is to exploit temporal variation patterns (TVPs) of domain names. The TVPs of domain names include information about how and when a domain name has been listed in legitimate/popular and/or malicious domain name lists. On the basis of this idea, our system actively collects DNS logs, analyzes their TVPs, and predicts whether a given domain name will be used for malicious purposes. Our evaluation revealed that our system can predict malicious domain names 220 days beforehand with a true positive rate of 0.985.
KW - DNS
KW - Malicious domain name
KW - Temporal variation pattern
UR - http://www.scopus.com/inward/record.url?scp=84994371738&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84994371738&partnerID=8YFLogxK
U2 - 10.1109/DSN.2016.51
DO - 10.1109/DSN.2016.51
M3 - Conference contribution
AN - SCOPUS:84994371738
T3 - Proceedings - 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2016
SP - 491
EP - 502
BT - Proceedings - 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2016
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 28 June 2016 through 1 July 2016
ER -