Segugio: Efficient Behavior-Based Tracking of Malware-Control Domains in Large ISP Networks

摘要: In this paper, we propose Segugio, a novel defense system that allows for efficiently tracking the occurrence of new malware-control domain names in very large ISP networks. Segugio passively monitors DNS traffic to build machine-domain bipartite graph representing who is querying what. After labelling nodes query behavior are known be either benign or malware-related, approach accurately detect previously unknown domains. We implemented proof-of-concept version and deployed it networks serve millions users. Our experimental results show can track domains with up 94% true positives (TPs) at less than 0.1% false (FPs). addition, provide following results: (1) also control related new, unseen malware families, 85% TPs FPs, (2) Segugio's detection models learned on from given network into different still achieve high accuracy, (3) detected days even weeks before they appear commercial name blacklist, (4) clearly outperforms Notos, proposed reputation system.