SLIDE 1
2
Spam domain registrations
Kreibich et al., “Spamcraft: An inside look at spam campaign orchestration” LEET 2009
(CCIED: The Collaborative Center for Internet Epidemiology and Defenses)
On the Potential of Proactive Domain Blacklisting Mrk Flegyhzi, - - PowerPoint PPT Presentation
On the Potential of Proactive Domain Blacklisting Mrk Flegyhzi, - - PowerPoint PPT Presentation
On the Potential of Proactive Domain Blacklisting Mrk Flegyhzi, Christian Kreibich and Vern Paxson ICSI, Berkeley Spam domain registrations Kreibich et al., Spamcraft: An inside look at spam campaign orchestration LEET 2009 (CCIED:
SLIDE 2
SLIDE 3
3
Spam domain registrations
Kreibich et al., “Spamcraft: An inside look at spam campaign orchestration” LEET 2009
(CCIED: The Collaborative Center for Internet Epidemiology and Defenses)
- domains dropped soon after
blacklisted
SLIDE 4
4
Spam domain registrations
Kreibich et al., “Spamcraft: An inside look at spam campaign orchestration” LEET 2009
(CCIED: The Collaborative Center for Internet Epidemiology and Defenses)
- domains dropped soon after
blacklisted
- domains registered in batches
SLIDE 5
5
Proactive domain clustering
SLIDE 6
6
Proactive domain clustering
SLIDE 7
7
Name server features
.COM zone file - NS records
SLIDE 8
8
Name server features
.COM zone file - NS records
SLIDE 9
9
Name server features
.COM zone file - NS records
SLIDE 10
10
Name server features
.COM zone file - NS records
SLIDE 11
11
Name server features
.COM zone file - NS records
SLIDE 12
12
Registration features
WHOIS registry records
SLIDE 13
13
Registration features
WHOIS registry records
SLIDE 14
14
Registration features
WHOIS registry records
SLIDE 15
15
Evaluation
SLIDE 16
16
Evaluation
SLIDE 17
17
Evaluation
SLIDE 18
18
Evaluation
SLIDE 19
19
Evaluation
SLIDE 20
20
Prediction accuracy
SLIDE 21
21
Prediction accuracy
- good true positive rate, only few false positives
- # of false positives vary across clusters
– 84% of clusters have no potential FPs (unknown)
SLIDE 22
22
A note on false positives
- some other clusters (example: 123 domains, 119 FP)
– many noun-noun domains
SLIDE 23
23
A note on false positives
- some other clusters (example: 123 domains, 119 FP)
– many noun-noun domains
SLIDE 24
24
A note on false positives
- some other clusters (example: 123 domains, 119 FP)
– many noun-noun domains
SLIDE 25
25
A note on false positives
- some other clusters (example: 123 domains, 119 FP)
– many noun-noun domains
SLIDE 26
26
A note on false positives
- some other clusters (example: 123 domains, 119 FP)
– many noun-noun domains
- large cluster: 1746 domains
– part of a set of 80k domains – registered under a single name in Albania in Jan and Feb 2010
SLIDE 27
27
Time to blacklisting
SLIDE 28
28
Time to blacklisting
SLIDE 29
29
Time to blacklisting
SLIDE 30
30
Summary
- domains registered and used in clusters
SLIDE 31
31
Summary
- domains registered and used in clusters
- more malicious domains based on a few seeds and
domain registry information
SLIDE 32
32
Summary
- domains registered and used in clusters
- more malicious domains based on a few seeds and
domain registry information
- good accuracy
– 73% of inferred domains on blacklists – 93% of domains are suspicious – false positives are often true positives
SLIDE 33
33
Summary
- domains registered and used in clusters
- more malicious domains based on a few seeds and
domain registry information
- good accuracy
– 73% of inferred domains on blacklists – 93% of domains are suspicious – false positives are often true positives
- faster than blacklists for 92% of the inferred malicious
domains
SLIDE 34
34
Summary
- domains registered and used in clusters
- more malicious domains based on a few seeds and
domain registry information
- good accuracy
– 73% of inferred domains on blacklists – 93% of domains are suspicious – false positives are often true positives
- faster than blacklists for 92% of the inferred malicious
domains
early response to spam
SLIDE 35
35
Spam and click volumes
Kanich et al., “Spamalytics: An empirical analysis of spam marketing conversion” CCS 2008
(CCIED: The Collaborative Center for Internet Epidemiology and Defenses)
SLIDE 36
36
Spam and click volumes
Kanich et al., “Spamalytics: An empirical analysis of spam marketing conversion” CCS 2008
(CCIED: The Collaborative Center for Internet Epidemiology and Defenses)
SLIDE 37
37
Name server ages
SLIDE 38
38
NS features
- 82.2% of domains encounter fresh name servers
SLIDE 39
39
Registration clusters
SLIDE 40
40