From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware
By Manos Antonakakis, Roberto Perdisci, Yacin Nadji, Nikolaos Vasiloglou, Saeed Abu-Nimeh, Wenke Lee, David Dagon. USENIX Security Symposium, 2012
569 citations recorded by the source corpus.
View Paper: https://www.semanticscholar.org/paper/a1055605f1837a34960ccb0377053978ad693fca
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
- Battista Biggio
- Fabio Roli
- Giorgio Fumera
- Roberto Perdisci
- Davide Maiorca
- Alina Oprea
- Joseph Gardiner
- Engin Kirda
Citations in the corpus
- Malicious URL Detection using Machine Learning: A Survey (2017, background): “[11] look into analyzing streams of unsuccessful domain name resolutions.”
- Understanding the Mirai Botnet (2017, background): “Unfortunately, mitigation remains a difficult problem as botnets often evolve to avoid disruption [6].”
- Practical Attacks Against Graph-based Clustering (2017, methodology): “Our goal is to devise generic attacks on graphs and demonstrate their effectiveness against a real-world system, called Pleiades [9].”
- Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains (2014, background): “The recently presented third work proposes a system that analyzes NoneXistent (NX) domain responses to detect domains that are automatically generated by an algorithm without reversing [Antonakakis et al. 2012].”
- Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, unknown): “[6]).”
- POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, methodology): “DNS logs have also been extensively used [1, 2] for detecting malicious domains.”
- MARVIN: Efficient and Comprehensive Mobile App Classification through Static and Dynamic Analysis (2015, methodology): “For DNS requests we extract the queried domain names as well as responses, as unsuccessful DNS resolutions (NXDOMAIN) can indicate malicious apps using domain generation algorithms [52].”
- Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “Another branch of research aims to detect dynamically generated malicious domains by modeling their lexical structures and utilizing the high number of failed DNS queries observed in botnets using such domains [7, 38, 39].”
- Pattern Recognition Systems under Attack: Design Issues and Research Challenges (2014, background): “For instance, in malware detection systems malware samples collected through “honeypots” are clustered (before pre-processing and feature extraction) for reducing the training set size, and for unsupervised ground truth assessment before human supervision[63, 2, 61].”