Mining agile DNS traffic using graph analysis for cybercrime detection

摘要: We consider the analysis of network traffic data for identifying highly agile DNS patterns which are widely considered indicative cybercrime. In contrast to related approaches, our methodology is capable explicitly distinguishing between individual, inherent agility benign Internet services and criminal sites. Although some use a large number addresses, they confined subset IP due operational requirements contractual agreements with certain Content Distribution Networks. discuss DNSMap, system analyzes observed traffic, continuously learns FQDNs hosted on addresses. Any significant changes over time mapped bipartite graphs, then further pruned cybercrime activity. Graph enables detection transitive relations IPs, reveals clusters malicious addresses hosting them. developed prototype designed realtime analysis, requires no costly classifier retraining, excessive whitelisting. evaluate using sets from an ISP several 100,000 customers, demonstrate that even moderately sites can be detected reliably almost immediately.