Method to identify malicious web domain names thanks to their dynamics
Methods and systems for detecting malicious domains. The method comprises storing domain data for a plurality of domains and selecting a relationship parameter which represents a relationship between at least two of the domains. The method further comprises generating a graph for the domains by identifying a plurality of domain nodes, connecting the domain nodes with a plurality of edges and calculating an edge weight for each edge. The method further comprises identifying at least one domain node as a known malicious domain node and the other domain nodes as candidate domain nodes, calculating a malicious score for each candidate domain node based on the edge weights and identifying a domain in the plurality of domains as malicious if the malicious score is within a predetermined range.
1. A method for detecting malicious domains in a network including a processor, the method comprising:
storing domain data for a plurality of domains;
selecting a relationship parameter, which represents a relationship between at least two of the domains;
generating a graph for the domains by:
identifying a plurality of domain nodes, which each corresponds to one of the plurality of domains;
connecting the domain nodes with a plurality of edges, each edge connecting two domain nodes that are related to one another by the selected relationship parameter; and
calculating an edge weight for the each edge, which represents the strength of a relationship between the domains of the domain nodes connected by the each edge;
identifying at least one domain node as a known malicious domain node and the other domain nodes as a candidate domain node;
calculating a malicious score for each candidate domain node based on the edge weight of the each edge connecting the candidate domain node to the known malicious domain node; and
identifying a domain in the plurality of domains as malicious if the malicious score for the candidate domain node of the domain is within a predetermined range of malicious scores,
wherein the domain data is Domain Name System (DNS) data, which comprises a DNS record for each of the domains,
wherein the DNS record further comprises first timestamp data indicating a first time at which the domain was resolved to a corresponding IP address and second timestamp data indicating a second time at which the domain was resolved to the IP address, the second time being more recent than the first time.
2. The method of claim 1 , wherein the DNS data comprises a plurality of DNS records for the plurality of domains stored at a predetermined time.
3. The method of claim 1 , wherein each DNS record comprises a first domain identifier and a second domain identifier for a respective one of the plurality of domains.
4. The method of claim 3 , wherein the first domain identifier indicates a domain name and the second domain identifier indicates an IP address for the domain.
5. The method of claim 1 , wherein the second time is the last time at which the domain was resolved to the IP address.
6. The method of claim 1 , further comprising:
selecting the plurality of domains from the DNS data by selecting the domains having a DNS record with first and second timestamps that are within a predetermined time observation window.
7. The method of claim 1 , wherein the relationship parameter is indicative of a similarity between a plurality of the DNS records.
8. The method of claim 1 , wherein the relationship parameter is indicative of a plurality of the domains resolving to the same IP address.
9. The method of claim 1 , wherein the relationship parameter is indicative of domains that have been controlled by a similar set of entities.
10. The method of claim 1 , wherein the predetermined range of malicious scores is a range of malicious scores in excess of a predetermined threshold.
11. The method of claim 1 , wherein the predetermined range of malicious scores is a range of malicious scores below a predetermined threshold.
12. A non-transitory computer readable medium storing instructions for performing a process to be executed by a processor, the process comprising:
storing domain data for a plurality of domains;
selecting a relationship parameter, which represents a relationship between at least two of the domains;
generating a graph for the domains by:
identifying a plurality of domain nodes, which each corresponds to one of the plurality of domains;
connecting the domain nodes with a plurality of edges, each edge connecting two domain nodes that are related to one another by the selected relationship parameter; and
calculating an edge weight for the each edge, which represents the strength of a relationship between the domains of the domain nodes connected by the each edge;
identifying at least one domain node as a known malicious domain node and the other domain nodes as a candidate domain node;
calculating a malicious score for each candidate domain node based on the edge weight of the each edge connecting the candidate domain node to the known malicious domain node; and
identifying a domain in the plurality of domains as malicious if the malicious score for the candidate domain node of the domain is within a predetermined range of malicious scores,
wherein the domain data is Domain Name System (DNS) data, which comprises a DNS record for each of the domains,
wherein the DNS record further comprises first timestamp data indicating a first time at which the domain was resolved to a corresponding IP address and second timestamp data indicating a second time at which the domain was resolved to the IP address, the second time being more recent than the first time.
13. A system for detecting malicious domains, the system comprising:
a processor; and
memory configured to store domain data for a plurality of domains and a relationship parameter, which represents a relationship between at least two of the domains, wherein the memory stores machine readable instructions which, when executed by the processor, cause the processor to:
generate a graph for the domains by:
identifying a plurality of domain nodes, which each corresponds to one of the plurality of domains;
connecting the domain nodes with a plurality of edges, each edge connecting two domain nodes that are related to one another by the selected relationship parameter; and
calculating an edge weight for the each edge, which represents the strength of a relationship between the domains of the domain nodes connected by the each edge;
identify at least one domain node as a known malicious domain node and the other domain nodes as a candidate domain node;
calculate a malicious score for each candidate domain node based on the edge weight of the each edge connecting the candidate domain node to the known malicious domain node; and
identify a domain in the plurality of domains as malicious if the malicious score for the candidate domain node of the domain is within a predetermined range of malicious scores,
wherein the domain data is Domain Name System (DNS) data, which comprises a DNS record for each of the domains,
wherein the DNS record further comprises first timestamp data indicating a first time at which the domain was resolved to a corresponding IP address and second timestamp data indicating a second time at which the domain was resolved to the IP address, the second time being more recent than the first time.
14. The system of claim 13 , wherein the DNS data comprises a plurality of DNS records for the plurality of domains stored at a predetermined time.
15. The system of claim 13 , wherein each DNS record comprises a first domain identifier and a second domain identifier for a respective one of the plurality of domains.
16. The system of claim 15 , wherein the first domain identifier indicates a domain name and the second domain identifier indicates an IP address for the domain.
17. The system of claim 13 , wherein the second time is the last time at which the domain was resolved to the IP address.
18. The system of claim 13 , wherein the memory stores machine readable instructions which, when executed by the processor, further cause the processor to:
select the plurality of domains from the DNS data by selecting the domains having a DNS record with first and second timestamps that are within a predetermined time observation window.
19. The system of claim 13 , wherein the relationship parameter is indicative of a similarity between a plurality of the DNS records.
20. The system of claim 13 , wherein the relationship parameter is indicative of a plurality of the domains resolving to the same IP address.
21. The system of claim 13 , wherein the relationship parameter is indicative of domains that have been controlled by a similar set of entities.
22. The system of claim 13 , wherein the predetermined range of malicious scores is a range of malicious scores in excess of a predetermined threshold.
23. The system of claim 13 , wherein the predetermined range of malicious scores is a range of malicious scores below a predetermined threshold.