Name Detection System By Auke Zwaan DNS DNS DNS Give me google. - - PowerPoint PPT Presentation

β–Ά
name detection system
SMART_READER_LITE
LIVE PREVIEW

Name Detection System By Auke Zwaan DNS DNS DNS Give me google. - - PowerPoint PPT Presentation

Oct 10, 2023 5 likes β€’458 views

Malicious Domain Name Detection System By Auke Zwaan DNS DNS DNS Give me google. gle.nl nl DNS Give me google. gle.nl nl Okay. 64.233. 4.233.166.9 66.94 Research Question Is it possible to detect ma malic iciou ious do domain

slide-1
SLIDE 1

Malicious Domain Name Detection System

By Auke Zwaan

slide-2
SLIDE 2

DNS

slide-3
SLIDE 3

DNS

slide-4
SLIDE 4

DNS

Give me google. gle.nl nl

slide-5
SLIDE 5

DNS

Give me google. gle.nl nl

  • Okay. 64.233.

4.233.166.9 66.94

slide-6
SLIDE 6
slide-7
SLIDE 7

Research Question

Is it possible to detect ma malic iciou ious do domain ins by analyzing interrelations between DN DNS reso esolver ers and blackli acklist sted ed do doma main ins?

slide-8
SLIDE 8

One giant DNS dataset

  • All DNS requests done to ns1.dns.nl
  • n January 6, 2016
  • 170M+ DNS Queries (+-7GB)
slide-9
SLIDE 9

DNS Data

slide-10
SLIDE 10

DNS Data

slide-11
SLIDE 11

DNS Data

slide-12
SLIDE 12

DNS Data

slide-13
SLIDE 13

DNS Data

slide-14
SLIDE 14

DNS Data

slide-15
SLIDE 15

DNS Data

slide-16
SLIDE 16

DNS Data

slide-17
SLIDE 17

DNS Data

slide-18
SLIDE 18

Nice, but what is a β€˜ma malicious icious domain main name me’?

slide-19
SLIDE 19

Initial blacklist

  • joewein.de LLC:

424 domains

  • SIDN Labs Sinkhole:

15 domains

  • Internet Storm Center (SANS):

14 domains

  • MalwareDomainList.com:

6 domains Total 459 domains

slide-20
SLIDE 20

DN DNS da data ta X Bl Blac ackli klist st = Poten enti tial ally Mal alici icious

  • us

Do Domain ins

slide-21
SLIDE 21

Processing the data

Sour urce ce Target rget Time mestam stamp

192.168.0.105 google.nl 1452091187 192.168.0.106 uva.nl 1452091187 192.168.0.232 nu.nl 1452091187 145.100.104.208

  • s3.nl

1452091187 192.168.0.108 bdcrqgonzmwuehky.nl 1452091187 145.100.104.208 hzmksreiuojy.nl 1452091187 145.100.104.208 xjpakmdcfuqe.nl 1452091187

slide-22
SLIDE 22

Processing the data

Sou

  • urce

ce Target rget

192.168.0.105 google.nl 192.168.0.106 uva.nl 192.168.0.232 nu.nl 145.100.104.208

  • s3.nl

192.168.0.108 bdcrqgonzmwuehky.nl 145.100.104.208 hzmksreiuojy.nl 145.100.104.208 xjpakmdcfuqe.nl

slide-23
SLIDE 23

Processing the data

Sou

  • urce

ce Target rget

192.168.0.105 google.nl 192.168.0.106 uva.nl 192.168.0.232 nu.nl 145.100.104.208

  • s3.nl

192.168.0.108 bdcrqgonzmwuehky.nl 145.100.104.208 hzmksreiuojy.nl 145.100.104.208 xjpakmdcfuqe.nl

slide-24
SLIDE 24

Grouping queries, suspicious resolvers only

Sou

  • urce

ce Target rget

145.100.104.208

  • s3.nl

hzmksreiuojy.nl xjpakmdcfuqe.nl aanrechtblad-kopen.nl 192.168.0.108 bdcrqgonzmwuehky.nl replicarolex.nl google.nl

slide-25
SLIDE 25

Flagging malicious domains

Sou

  • urce

ce Target rget Ma Malicious licious

145.100.104.208

  • s3.nl

Unknown hzmksreiuojy.nl Yes xjpakmdcfuqe.nl Yes aanrechtblad-kopen.nl Unknown 192.168.0.108 bdcrqgonzmwuehky.nl Yes replicarolex.nl Unknown google.nl Unknown

slide-26
SLIDE 26

Processing the data

Sou

  • urce

ce Ma Malicious licious Un Unkno known wn

145.100.104.208 2 2 192.168.0.108 1 2 192.168.0.106 1 6 192.168.0.105 1 5

slide-27
SLIDE 27

Defining the mal alic iciousness iousness ra ratio io

π‘π‘π‘šπ‘—π‘‘π‘—π‘π‘£π‘‘π‘œπ‘“π‘‘π‘‘ 𝑆𝑏𝑒𝑗𝑝 = 𝑂𝑣𝑛𝑐𝑓𝑠 𝑝𝑔 π‘Ÿπ‘£π‘“π‘ π‘—π‘“π‘‘ 𝑒𝑝 π’π’ƒπ’Žπ’‹π’…π’‹π’‘π’—π’• 𝒆𝒑𝒏𝒃𝒋𝒐𝒕 𝑂𝑣𝑛𝑐𝑓𝑠 𝑝𝑔 π‘Ÿπ‘£π‘“π‘ π‘—π‘“π‘‘ 𝑒𝑝 𝒗𝒐𝒍𝒐𝒑𝒙𝒐 𝒆𝒑𝒏𝒃𝒋𝒐𝒕

slide-28
SLIDE 28

Processing the data

Sou

  • urce

ce Ma Malicious licious Un Unkno known wn Ratio tio

145.100.104.208 2 2 1.0 1.0 192.168.0.108 1 2 0.5 192.168.0.106 1 6 0.167 67 192.168.0.105 1 4 0.25 25 192.168.0.232 4 300 0.013

slide-29
SLIDE 29

Assumption 1

A ma malicious icious res esolv lver er is a resolver for which the maliciousness ratio β‰₯ 0.25

slide-30
SLIDE 30

Processing the data

Sou

  • urce

ce Ma Malicious licious Un Unkno known wn Ratio tio

145.100.104.208 2 2 1.0 1.0 192.168.0.108 1 2 0.5 192.168.0.106 1 6 0.167 67 192.168.0.105 1 4 0.25 25 192.168.0.232 4 300 0.013

slide-31
SLIDE 31

Finding malicious domains

  • Get all the domains requested by malic

icious ious res esolv lver ers

  • Filter out the domains from the initial blacklist
slide-32
SLIDE 32

Assumption 2

The 100 most popular .nl domain names are not ma malicious icious

slide-33
SLIDE 33

Results

  • 40,469

469 queries to malicious domains

  • 8,132 suspicious resolvers, doing 85M+

M+ queries

  • 673

673 malicious resolvers (maliciousness ratio β‰₯ 0.25)

  • 413 potentially malicious domains
  • 392

392 potentially malicious domains (minus top 100)

slide-34
SLIDE 34

Assumption 3

If a website has at t lea east st one hit in VirusTotal in the past, it is considered malicious

slide-35
SLIDE 35

Example

www.ikhouvanirakezen.nl

Detected by VirusTotal thus tr true positiv itive

slide-36
SLIDE 36

Example 2

No hits on VirusTotal

  • Manual Google Search:
  • Hits:

Classification β€œYes”

  • No hits:

Classification β€œNo”

  • Hosting provider:

Classification β€œPossibly”

  • Search not feasible:

Classifcation β€œUnknown”

slide-37
SLIDE 37

Ma Mali liciou cious Numb mber er of doma mains ins Yes 125 No 153 Possibly 111 Unknown 3 Total tal 392 92

slide-38
SLIDE 38

Evaluation: 32 test rounds

DN DNS da data ta X Bl Blac ackli klist st = Poten enti tial ally Mal alici icious

  • us

Do Domain ins

slide-39
SLIDE 39

Blacklist acklist Training ining set t (9 (90% 0%) Tes est t set t (1 (10% 0%)

DN DNS da data ta X Poten enti tial ally Mal alici icious

  • us

Do Doma main ins

Trying to find domains from a test set

slide-40
SLIDE 40

Blacklist acklist Training ining set t (9 (90% 0%) Tes est t set t (1 (10% 0%)

DN DNS da data ta X Poten enti tial ally Mal alici icious

  • us

Do Doma main ins

Trying to find domains from a test set

slide-41
SLIDE 41

Evaluation: 32 test rounds

Min Max Mean Std # # Pot

  • tent

ntia ially maliciou cious domai ains ns 114 400 400 349.875 75 68.295 # # From test t set et found und 5 2.594 94 1. 1.316

slide-42
SLIDE 42

Conclusion

  • It is possible to find malicious domains by looking at

spatial co-occurrence of DNS queries

  • 31.8% true positives, so not suitable for blacklisting
  • Instead, use as factor for further analysis
slide-43
SLIDE 43

Future work

  • Add a content analysis for each potentially malicious domain

(i.e. crawling), and apply NLP

  • Compare lists between different dates (datasets) and analyze

commonly found domains

  • Look at whois info for potentially malicious domains and use it

for finding malicious registrars

slide-44
SLIDE 44

Future work

  • Extend blacklists (or run the algorithm recursively)
  • Use the maliciousness ratio to identify most β€˜dangerous’

resolvers

  • 111x β€˜Possibly’: strip out hosting providers?
slide-45
SLIDE 45

Qu Questions estions?

Thanks for your attention!