Efficient and Accurate Behavior-Based Tracking of Malware-Control Domains in Large ISP Networks

摘要: In this article, we propose Segugio, a novel defense system that allows for efficiently tracking the occurrence of new malware-control domain names in very large ISP networks. Segugio passively monitors DNS traffic to build machine-domain bipartite graph representing who is querying what. After labeling nodes query behavior are known be either benign or malware-related, approach accurately detect previously unknown domains.We implemented proof-of-concept version and deployed it networks serve millions users. Our experimental results show can track domains with up 94p true positives (TPs) at less than 0.1p false (FPs). addition, provide following results: (1) also control related new, unseen malware families, 85p TPs FPs; (2) Segugio’s detection models learned on from given network into different still achieve high accuracy; (3) detected days even weeks before they appear commercial domain-name blacklist; (4) used malware-infected machines networks; (5) clearly outperforms domain-reputation systems based Belief Propagation.