VB2014 paper: We know it before you do: predicting malicious domains

Wei Xu and his colleagues attempt to block domains before they’re used for bad purposes.

Since the close of the VB2014 conference in Seattle in October, we have been sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added ‘We know it before you do: predicting malicious domains’ by Palo Alto Networks researchers Wei Xu, Yanxin Zhang and Kyle Sanders.

Whether they’re used for command and control communication, to host malware or in a phishing campaign, malicious domains play an important role in today’s threats. Security firms thus try hard to detect them and add them to their blacklists.

However, with domains being recycled quickly, a reactive approach might not be good enough. In their VB2014 paper,

Palo Alto Networks

researchers Wei Xu, Yanxin Zhang and Kyle Sanders describe how they tried to predict malicious domains.

They combine four different techniques: looking at known malicious domain names that are likely to be reused; looking at the domain names themselves to detect those generated by

DGAs

; looking at DNS queries made to the domains; and looking at connections between the domain names, such as shared DNS infrastructure.

Using these techniques and one month’s data as input, they were able to predict almost 2,200 malicious domains, 83% of which were listed on

VirusTotal

as known malicious by at least one vendor. Passive DNS records showed that they predicted malicious domains an average of eight hours before DNS queries showed up in the PDNS feed.

You can read the paper

here

in HTML-format, or download it

here

as a PDF (no registration or subscription required). We have also uploaded the presentation to our

YouTube

channel.

Posted on 05 February 2015 by

Martijn Grooten