Detecting Malware Domains at the Upper DNS Hierarchy

By Manos Antonakakis, Roberto Perdisci, Wenke Lee, Nikolaos Vasiloglou, David Dagon. USENIX Security Symposium, 2011

329 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/2851877f767ee09e913dc3604ec4f1e5c3793aec

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, methodology): “DNS logs have also been extensively used [1, 2] for detecting malicious domains.”
Early Detection of Malicious Flux Networks via Large-Scale Passive DNS Traffic Analysis (2012, background): “Our work is significantly different from [10], which focuses mainly on HTTP traffic generated by single clients and may not scale well in very large networks.”
Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains (2014, background): “…is heavily abused by attackers today, there has been a considerable amount of work that seeks to develop DNS-based malware detection mechanisms [Antonakakis et al. 2010, 2011, 2012; Holz et al. 2008; Perdisci et al. 2009] including our previous work, in which we presented the EXPOSURE…”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, unknown): “In a more general approach, EXPOSURE [9], Notos [5], and Kopis [6] perform passive DNS analysis to identify malicious domains.”
On the Security of Machine Learning in Malware C&C Detection (2016, background): “Even if all of the data can be stored (which is not guaranteed on larger networks), the processing of the data (such as applying an C&C detection technique) is far less scalable and will almost certainly encounter issues on a large system.”
Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, background): “, EXPOSURE [8], Notos [4], Kopis [5], and Antonakakis et al.”
PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration (2016, background): “Existing DNS reputation systems primarily use characteristics of DNS lookups to distinguish legitimate domains from malicious ones [3, 4, 5].”
Malicious URL Detection using Machine Learning: A Survey (2017, unknown): “heir identity by using proxy networks and quickly changing their host [40, 80]. [9] propose using additional host-based features including BGP prefixes and honeypot features. This work is extended in [10] where traffic features are incorporated. [11] look into analyzing streams of unsuccessful domai”
CAMP: Content-Agnostic Malware Protection (2013, background): “The action of visiting a malicious web page in a vulnerable browser is sufficient for an adversary to gain complete control over the vulnerabl machine allowing her to install arbitrary software.”
Proactive Discovery of Phishing Related Domain Names (2012, methodology): “In [2–4], the building of classification models relies on passively gathered DNS queries to figure out predominantly malware domains involved in botnet communications.”