Unsupervised Clustering for Identification of Malicious Domain Campaigns

摘要: New malicious domain campaigns often include large sets of domains registered in bulk and deployed simultaneously. Early identification these can be accomplished with distance functions or regular expressions domains, but methods may also miss some campaign domains. Other studies have used time-of-registration features to help identify This paper explores the use unsupervised clustering based on passive DNS records other inherent network information that part resistant detection by name analysis alone. We found using this method, we achieve up 2.1x expansion from a seed known less than 4% false positives. could useful tool augment identifying