Building a Dynamic Reputation System for DNS

By Manos Antonakakis, Roberto Perdisci, David Dagon, Wenke Lee, N. Feamster. USENIX Security Symposium, 2010

520 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/cbb1f6130d5816dc06fbe3e835244127ef737b7f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration (2016, background): “Existing DNS reputation systems primarily use characteristics of DNS lookups to distinguish legitimate domains from malicious ones [3, 4, 5].”
Insights into User Behavior in Dealing with Internet Attacks (2012, background): “We also show that trick banners that are common in file sharing websites and shortened URLs have high success rates of deceiving non-technical users, thus posing a severe security risk.”
Understanding the Mirai Botnet (2017, methodology): “Using both passive and active DNS datasets, we performed DNS expansion to identify shared DNS infrastructure by linking related historic domain names (RHDN) and related historic IPs (RHIPs) [5].”
From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware (2012, background): “Lastly, we note that our work is complementary to the larger collection of previous research that attempts to detect and identify malicious domain names, e.g., [3, 4].”
EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis (2011, methodology): “Hence, unlike Notos, we are able to detect such domains.”
Guilt by association: large scale malware detection by mining file-relation graphs (2014, background): “There exist reputation systems that have been developed to address security-related problems, such as reputation scoring for IP addresses [1] and DNS entries [2, 3].”
Malicious URL Detection using Machine Learning: A Survey (2017, background): “t-string based features are generated. DNS Fluxiness features were proposed to look for malicious URLs that would hide their identity by using proxy networks and quickly changing their host [40, 80]. [9] propose using additional host-based features including BGP prefixes and honeypot features. This ”
Practical Attacks Against Graph-based Clustering (2017, unknown): “Finally, an attacker has full knowledge of the features, machine learning algorithms, and hyperparameters used in both the unsupervised and supervised phases of the system under attack, as these are often published [8, 9, 20, 29, 41, 45, 48].”
Proactive Discovery of Phishing Related Domain Names (2012, methodology): “…classify on the ﬂy, domains as malicious or benign is widely used, with either batch methods such as SVM, Naive Bayes, Logistic Regression(like in [2–4]), or on-line classiﬁ-cation algorithms such as Conﬁdence Weighted (CW), Adaptive Regularization of Weight (AROW), Passive-Aggressive (PA) (see…”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, unknown): “In a more general approach, EXPOSURE [9], Notos [5], and Kopis [6] perform passive DNS analysis to identify malicious domains.”
CAMP: Content-Agnostic Malware Protection (2013, background): “Some of the client features such as the content hash are used directly in subsequent aggregate lookups.”
Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains (2014, background): “…is heavily abused by attackers today, there has been a considerable amount of work that seeks to develop DNS-based malware detection mechanisms [Antonakakis et al. 2010, 2011, 2012; Holz et al. 2008; Perdisci et al. 2009] including our previous work, in which we presented the EXPOSURE…”
On the Security of Machine Learning in Malware C&C Detection (2016, methodology): “One proposed detection method is to make use of the reputation of domain names to decide if they are related to malicious activities [Antonakakis et al. 2010].”
Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, background): “, EXPOSURE [8], Notos [4], Kopis [5], and Antonakakis et al.”
Detecting Malware Domains at the Upper DNS Hierarchy (2011, background): “The choice of the RD features is motivated by the observation that the distribution of the machines on the Internet that query malicious domain names is on average different from the distribution of IP addresses that query legitimate domains.”