IMDoC: Identification of Malicious Domain Campaigns via DNS and Communicating Files
| Autor: | Kobi Cohen, Avishay Bartik, Alon Freund, Aviv Ron, David Lazar |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2021 |
| Předmět: |
General Computer Science
Computer science Domain Name System domain name system (DNS) General Engineering 020206 networking & telecommunications 02 engineering and technology Computer security computer.software_genre Cyber security Phishing Identification (information) detection algorithms Server clustering methods 0202 electrical engineering electronic engineering information engineering Command and control Malware Cyber-attack 020201 artificial intelligence & image processing General Materials Science lcsh:Electrical engineering. Electronics. Nuclear engineering computer lcsh:TK1-9971 Security operations center |
| Zdroj: | IEEE Access, Vol 9, Pp 45242-45258 (2021) |
| ISSN: | 2169-3536 |
| Popis: | Cyber attacks have become more sophisticated and frequent over the years. Detecting the components operated during a cyber attack and relating them to a specific threat actor is one of the main challenges facing cyber security systems. Reliable detection of malicious components and identification of the threat actor is imperative to mitigate security issues by Security Operations Center (SOC) analysts. The Domain Name System (DNS) plays a significant role in most cyber attacks observed nowadays in that domains act as a Command and Control (C&C) in coordinated bot network attacks or impersonate legitimate websites in phishing attacks. Thus, DNS analysis has become a popular tool for malicious domain identification. In this collaborative research associating Ben-Gurion University and IBM, we develop a novel algorithm to detect malicious domains and relate them to a specific malware campaign in a large-scale real-data DNS traffic environment, dubbed Identification of Malicious Domain Campaigns (IMDoC) algorithm. Its novelty resides in developing a framework that combines the existence of communicating files for the observed domains and their DNS request patterns in a real production environment. The analysis was conducted on real data from Quad9 (9.9.9.9) DNS recursive resolvers combined with malicious communicating files extracted from VirusTotal, and confirms the strong performance of the algorithm on a real large-scale data production environment. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|