Don't Let One Rotten Apple Spoil the Whole Barrel: Towards Automated Detection of Shadowed Domains

摘要: Domain names have been exploited for illicit online activities decades. In the past, miscreants mostly registered new domains their attacks. However, malicious purposes can be deterred by existing reputation and blacklisting systems. response to arms race, recently adopted a strategy, called domain shadowing, build attack infrastructures. Specifically, instead of registering domains, are beginning compromise legitimate ones spawn subdomains under them. This has rendered almost all countermeasures ineffective fragile because inherit trust apex attackers virtually an infinite number shadowed domains. this paper, we conduct first study understand detect emerging threat. Bootstrapped with set manually confirmed identify novel features that uniquely characterize shadowing analyzing deviation from correlation among different Building upon these features, train classifier apply it on daily feeds VirusTotal, large open security scanning service. Our highlights as increasingly rampant Moreover, while previously campaigns exclusively involved in exploit kits, reveal they also widely phishing Finally, observe algorithmically generating subdomain names, several cases wildcard DNS records.