DomainChroma: Building actionable threat intelligence from malicious domain names

Daiki Chiba*, Mitsuaki Akiyama, Takeshi Yagi, Kunio Hato, Tatsuya Mori, Shigeki Goto

*この研究の対応する著者

研究成果: Article査読

10 被引用数 (Scopus)

抄録

Since the 1980s, domain names and the domain name system (DNS) have been used and abused. Although legitimate Internet users rely on domain names as indispensable infrastructures for using the Internet, attackers use or abuse them as reliable, instantaneous, and distributed attack infrastructures. However, there is a lack of complete understanding of such domain-name abuses and methods for coping with them. In this study, we designed and implemented a unified analysis system combining current defense solutions to build actionable threat intelligence from malicious domain names. The basic concept underlying our system is malicious domain name chromatography. Our analysis system can distinguish among mixtures of malicious domain names for websites. On the basis of this concept, we do not create a hodgepodge of current solutions but design separation of abused domain names and offer actionable threat intelligence or defense information by considering the characteristics of malicious domain names as well as the possible defense solutions and points of defense. Finally, we evaluated our analysis system and defense-information output using a large real dataset to show the effectiveness and validity of our system.

本文言語English
ページ(範囲)138-161
ページ数24
ジャーナルComputers and Security
77
DOI
出版ステータスPublished - 2018 8月

ASJC Scopus subject areas

  • コンピュータ サイエンス(全般)
  • 法学

フィンガープリント

「DomainChroma: Building actionable threat intelligence from malicious domain names」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル