EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis

By Leyla Bilge, Engin Kirda, Christopher Krügel, Marco Balduzzi. Network and Distributed System Security Symposium, 2011

665 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/84e1181cee354c9342732e71ee656ac7d69ac9eb

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Proactive Discovery of Phishing Related Domain Names (2012, methodology): “In [2–4], the building of classiﬁcation models relies on passively gathered DNS queries to ﬁgure out predominantly malware domains involved in botnet communications.”
Malicious URL Detection using Machine Learning: A Survey (2017, background): “Content-features usually require down-loading the web-page which would affect the feature collection time.”
Guilt by association: large scale malware detection by mining file-relation graphs (2014, background): “There exist reputation systems that have been developed to address security-related problems, such as reputation scoring for IP addresses [1] and DNS entries [2, 3].”
Packet Transactions: High-Level Programming for Line-Rate Switches (2015, background): “Examples include active queue management [53, 52, 67, 74, 76], scheduling [88], congestion control with switch feedback [64, 93, 60, 28], network measurement [98, 51, 50], security [34], and trafﬁc load balancing [27].”
On the Security of Machine Learning in Malware C&C Detection (2016, methodology): “EXPOSURE [Bilge et al. 2011] is a system for applying large-scale, passive DNS traffic analysis to identify malicious domains (not limited to those related to C&C behavior but rather those involved in any malicious behavior).”
PRISM - Privacy-Preserving Search in MapReduce (2012, unknown): “[5].”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, unknown): “In a more general approach, EXPOSURE [9], Notos [5], and Kopis [6] perform passive DNS analysis to identify malicious domains.”
From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware (2012, background): “Half of them are variants of known (botnet) DGAs, and the other half are brand new DGAs that have never been reported before.”
Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, background): “, EXPOSURE [8], Notos [4], Kopis [5], and Antonakakis et al.”
Sonata: query-driven streaming network telemetry (2018, methodology): “For example, a query for detecting malicious domains that requires counting the number of unique resolved IP address for each domain [6], can use the field dns.rr.name as a refinement key.”
CAMP: Content-Agnostic Malware Protection (2013, background): “Some of the client features such as the content hash are used directly in subsequent aggregate lookups.”
PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration (2016, background): “Existing DNS reputation systems primarily use characteristics of DNS lookups to distinguish legitimate domains from malicious ones [3, 4, 5].”
Detecting Malware Domains at the Upper DNS Hierarchy (2011, methodology): “We would like to emphasize that the features computed by Kopis, particularly the Requester Diversity and Requester Proﬁle features, are novel and very different from the statistical features proposed in Notos [3] and Exposure [4], which are heavily based on IP reputation information.”
Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, methodology): “Leveraging this information, we count the number of malicious domains detected in each AS and build a reputation score according to the density of maliciousness for each AS reported by EXPOSURE.”