DNS Traffic Analysis for Malicious Domains Detection
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F15%3A00080504" target="_blank" >RIV/00216224:14330/15:00080504 - isvavai.cz</a>
Result on the web
<a href="http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7095337&newsearch=true&searchWithin=%22First%20Name%22:Ibrahim&searchWithin=%22Last%20Name%22:Ghafir" target="_blank" >http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7095337&newsearch=true&searchWithin=%22First%20Name%22:Ibrahim&searchWithin=%22Last%20Name%22:Ghafir</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1109/SPIN.2015.7095337" target="_blank" >10.1109/SPIN.2015.7095337</a>
Alternative languages
Result language
angličtina
Original language name
DNS Traffic Analysis for Malicious Domains Detection
Original language description
The web has become the medium of choice for people to search for information, conduct business, and enjoy entertainment. At the same time, the web has also become the primary platform used by miscreants to attack users. For example, drive-by-download attacks, which could be through malicious domains, are a popular choice among bot herders to grow their botnets. In this paper we present our methodology for detecting any connection to malicious domain. Our detection method is based on a blacklist of malicious domains. We process the network traffic, particularly DNS traffic. We analyze all DNS requests and match the query with the blacklist. The blacklist of malicious domains is updated automatically and the detection is in the real time. We applied ourmethodology on a packet capture (pcap) file which contains traffic to malicious domains and we proved that our methodology can successfully detect the connections to malicious domains.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
IN - Informatics
OECD FORD branch
—
Result continuities
Project
<a href="/en/project/OFMASUN201301" target="_blank" >OFMASUN201301: CIRC - Mobile dedicated devices to fulfilling ability to respond to cyber incidents</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach
Others
Publication year
2015
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
Proceedings of International Conference on Signal Processing and Integrated networks
ISBN
9781479959914
ISSN
—
e-ISSN
—
Number of pages
6
Pages from-to
613-618
Publisher name
IEEE Xplore Digital Library
Place of publication
Noida, India
Event location
Noida, India
Event date
Feb 19, 2015
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—