PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration

摘要: Miscreants register thousands of new domains every day to launch Internet-scale attacks, such as spam, phishing, and drive-by downloads. Quickly accurately determining a domain's reputation (association with malicious activity) provides powerful tool for mitigating threats protecting users. Yet, existing domain systems work by observing use (e.g., lookup patterns, content hosted) often too late prevent miscreants from reaping benefits the attacks that they launch. As complement these systems, we explore extent which features evident at registration indicate subsequent activity. We develop PREDATOR, an approach uses only time-of-registration establish reputation. base its design on intuition need obtain many ensure profitability attack agility, leading abnormal behaviors burst registrations, textually similar names). evaluate PREDATOR using logs second-level .com .net over five months. achieves 70% detection rate false positive 0.35%, thus making it effective early first line defense against misuse DNS domains. It predicts when are registered, is typically days or weeks earlier than blacklists.