VB2017 paper: Beyond lexical and PDNS: using signals on graphs to uncover online threats at scale

Posted by   Martijn Grooten on   Nov 22, 2017

Malicious Internet traffic, such as botnet C&C traffic, is easily recognized if it uses known bad domain names, or known bad IP addresses. This is why botnets constantly change the domain names, and often also the IP addresses they use, thus trying to stay one step ahead of the defenders.

Enter big data: infected devices to tend to show behaviour that makes them stand out from the crowd. For instance, such machines tend to be very 'chatty' (i.e. make a lot of connections) with domains that are otherwise not particularly 'popular'.

This terminology comes from a VB2017 paper by Cisco Umbrella (formerly OpenDNS) researchers Dhia Mahjoub and David Rodriguez, who presented a new approach to detecting infected machines as well as botnet networks in the very large haystack of the Internet. 

fig_11.png

Today, we publish their paper 'Beyond lexical and PDNS: using signals on graphs to uncover online threats at scale' in both HTML and PDF format; we have also uploaded the video of their paper to our YouTube channel. If you're into big data and not afraid of some serious mathematics, make sure you read the paper and watch the video.

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

Virus Bulletin researcher discovers new Lord exploit kit

Still in-development kit thus far only targets Flash Player vulnerabilities

VB2019 call for last-minute papers opened

The call for last-minute papers for VB2019 is now open. Submit before 1 September to have your abstract considered for one of the nine slots reserved for 'hot' research.

Nominations opened for sixth Péter Szőr Award

Virus Bulletin is seeking nominations for the sixth annual Péter Szőr Award.

Haroon Meer and Adrian Sanabria to deliver VB2019 closing keynote

New additions to the VB2019 conference programme include a closing keynote address from Thinkst duo Haroon Meer and Adrian Sanabria and a talk on attacks against payment systems.

Free VB2019 tickets for students

Virus Bulletin is excited to announce that, thanks to generous sponsorship from Google Android, we are able to offer 20 free tickets to students who want to attend VB2019.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.