Strategically aged domain detection
Detection of strategically aged domains is detected. A list of aged dormant domains is determined, including by evaluating passive Domain Name System (DNS) information. The list of aged dormant domains is monitored for a change by an aged dormant domain from a dormant domain status to an active status. In response to determining the change to active status of the aged dormant domain, an action is taken with respect to the aged dormant domain.
1. A system, comprising:
a processor configured to:
determine, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information;
monitor the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status, at least in part by determining that a threshold volume of DNS traffic for the particular domain has been exceeded; and
in response to determining the change to active status of the particular domain, take a remedial action with respect to the particular domain; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein taking the remedial action includes determining whether the particular domain is associated with an algorithmically generated domain.
3. The system of claim 2 , wherein determining whether the particular domain is associated with the algorithmically generated domain includes performing Markov chain analysis.
4. The system of claim 2 , wherein determining whether the particular domain is associated with the algorithmically generated domain includes evaluating a DNS traffic pattern for an abnormality.
5. The system of claim 1 , wherein taking the remedial action includes determining whether the particular domain is associated with a phishing attack.
6. The system of claim 1 , wherein taking the remedial action includes determining whether the particular domain is associated with wildcard DNS abuse.
7. The system of claim 1 , wherein taking the remedial action includes adding the particular domain to a block list.
8. The system of claim 1 , wherein taking the remedial action includes responding to a DNS query with an indication that a DNS request indicates that a client has been compromised.
9. The system of claim 1 , wherein determining the list includes determining whether an average DNS request for a given domain is below a threshold for a given time window.
10. The system of claim 1 , wherein monitoring the list of candidate strategically aged domains includes determining whether an average DNS request for a given domain is above a threshold within a time window.
11. The system of claim 1 , wherein the processor is further configured to collect a first set of metrics quantifying activities associated with the particular domain prior to changing status and collect a second set of metrics quantifying activities associated with the particular domain after changing the status.
12. A method, comprising:
determining, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information;
monitoring the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status, at least in part by determining that a threshold volume of DNS traffic for the particular domain has been exceeded; and
in response to determining the change to active status of the particular domain, taking a remedial action with respect to the particular domain.
13. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
determining, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information;
monitoring the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status, at least in part by determining that a threshold volume of DNS traffic for the particular domain has been exceeded; and
in response to determining the change to active status of the particular domain, taking a remedial action with respect to the particular domain.
14. The method of claim 12 , wherein taking the remedial action includes determining whether the particular domain is associated with an algorithmically generated domain.
15. The method of claim 14 , wherein determining whether the particular domain is associated with the algorithmically generated domain includes performing Markov chain analysis.
16. The method of claim 14 , wherein determining whether the particular domain is associated with the algorithmically generated domain includes evaluating a DNS traffic pattern for an abnormality.
17. The method of claim 12 , wherein taking the remedial action includes determining whether the particular domain is associated with a phishing attack.
18. The method of claim 12 , wherein taking the remedial action includes determining whether the particular domain is associated with wildcard DNS abuse.
19. The method of claim 12 , wherein taking the remedial action includes adding the particular domain to a block list.
20. The method of claim 12 , wherein taking the remedial action includes responding to a DNS query with an indication that a DNS request indicates that a client has been compromised.
21. The method of claim 12 , wherein determining the list includes determining whether an average DNS request for a given domain is below a threshold for a given time window.
22. The method of claim 12 , wherein monitoring the list of candidate strategically aged domains includes determining whether an average DNS request for a given domain is above a threshold within a time window.
23. The method of claim 12 , further comprising collecting a first set of metrics quantifying activities associated with the particular domain prior to changing status and collecting a second set of metrics quantifying activities associated with the particular domain after changing the status.