The Black Mark Beside My Name Server: Exploring the Importance of Name Server IP Addresses in Malware DNS Graphs

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review

Researchers

  • Jukka Ruohonen
  • Sanja Scepanovic
  • Sami Hyrynsalmi
  • Igor Mishkovski
  • Tuomas Aura

  • Ville Leppänen

Research units

  • Univ Ss Cyril & Methodius
  • University of Turku

Abstract

This short exploratory empirical paper examines a question of how important the Internet protocol (IP) addresses of name servers are in linking together Internet domains that have distributed malware or otherwise having been associated with malicious computer networks. By using the domain name system (DNS) for building a relational representation, the found importance is elaborated with a dataset comprised of nearly sixty thousand domains. Besides the empirical exploration related to these domains, the paper provides a stylized discussion on the construction of empirical DNS graphs, including the concrete reduction and learning of the observed malware graph. With these two deliverables, the paper contributes to the active research field of DNS mining, further pinpointing a number of relevant research challenges for applications of complex network analysis for studying computer networking and cyber security.

Details

Original languageEnglish
Title of host publication2016 IEEE 4TH INTERNATIONAL CONFERENCE ON FUTURE INTERNET OF THINGS AND CLOUD WORKSHOPS (FICLOUDW)
EditorsM Younas, Awan, J ElHaddad
Publication statusPublished - 2016
MoE publication typeA4 Article in a conference publication
EventInternational Conference on Future Internet of Things and Cloud Workshops - Vienna, Austria
Duration: 22 Aug 201624 Aug 2016
Conference number: 4

Conference

ConferenceInternational Conference on Future Internet of Things and Cloud Workshops
Abbreviated title FiCloudW
CountryAustria
CityVienna
Period22/08/201624/08/2016

    Research areas

  • cyber security, fast flux, labeled network, NETWORKS

ID: 9814688