[论文解读] Killing Two Birds with One Stone: Malicious Domain Detection with High Accuracy and Coverage

Issa Khalil, Bei Guan+2 more|arXiv (Cornell University)|Nov 1, 2017

Network Security and Intrusion Detection参考文献 25被引用 4

一句话总结

本文提出了一种新颖的域名关联方案，通过在主动DNS数据中区分公共IP与专用IP，提升恶意域名检测的准确性与覆盖范围，实现对同一实体控制的域名之间精确、高覆盖的关联。该方法在检测准确率与覆盖范围方面显著优于基于共用IP的方法，并能与信念传播算法有效集成，实现可扩展的推理，且准确率损失极小。

ABSTRACT

Inference based techniques are one of the major approaches to analyze DNS data and detecting malicious domains. The key idea of inference techniques is to first define associations between domains based on features extracted from DNS data. Then, an inference algorithm is deployed to infer potential malicious domains based on their direct/indirect associations with known malicious ones. The way associations are defined is key to the effectiveness of an inference technique. It is desirable to be both accurate (i.e., avoid falsely associating domains with no meaningful connections) and with good coverage (i.e., identify all associations between domains with meaningful connections). Due to the limited scope of information provided by DNS data, it becomes a challenge to design an association scheme that achieves both high accuracy and good coverage. In this paper, we propose a new association scheme to identify domains controlled by the same entity. Our key idea is an in-depth analysis of active DNS data to accurately separate public IPs from dedicated ones, which enables us to build high-quality associations between domains. Our scheme identifies many meaningful connections between domains that are discarded by existing state-of-the-art approaches. Our experimental results show that the proposed association scheme not only significantly improves the domain coverage compared to existing approaches but also achieves better detection accuracy. Existing path-based inference algorithm is specifically designed for DNS data analysis. It is effective but computationally expensive. As a solution, we investigate the effectiveness of combining our association scheme with the generic belief propagation algorithm. Through comprehensive experiments, we show that this approach offers significant efficiency and scalability improvement with only minor negative impact of detection accuracy.

研究动机与目标

• 解决在有限主动DNS数据下，基于推理的恶意域名检测中实现高准确率与高覆盖的挑战。
• 克服简单共用IP关联方法的局限性，后者因共享公共托管基础设施而产生大量误报。
• 设计一种域名关联方案，基于对DNS解析模式中IP类型深度分析，捕捉域名之间的有意义、实体级别的关联关系。
• 评估所提出的关联方案与专用路径推理算法及通用信念传播算法结合后的可扩展性与效率。
• 证明所提方法在真实部署场景中，能够在检测准确率与计算效率之间实现有利的权衡。

提出的方法

• 该方法对主动DNS数据进行深入分析，根据其托管模式与使用特征，将IP地址分类为公共IP或专用IP。
• 仅在解析到同一专用IP的域名之间建立关联，避免因共享公共IP而产生的虚假链接。
• 利用时间一致性与解析模式，推断IP是否被多个无关域名共享（公共IP），或是否专用于单一实体（专用IP）。
• 将域名关联方案与信念传播（BP）推理算法集成，通过关联域名网络传播恶意性标签。
• 通过比较路径推理与通用BP算法，评估准确率与效率之间的权衡，结果表明BP在仅造成轻微准确率下降的情况下，显著提升了可扩展性。
• 在真实主动DNS数据集上评估该方法，使用已知恶意域名的真实标签来衡量检测性能。

实验结果

研究问题

• RQ1 基于专用IP识别的域名关联方案是否能相比共用IP方案显著提升检测准确率？
• RQ2 此类方案在不引入误报的前提下，能在多大程度上提升恶意域名检测的覆盖范围？
• RQ3 信念传播在与所提关联方案结合时，在可扩展性与准确率方面表现如何？
• RQ4 与专用路径推理相比，使用通用BP在推理效率与检测准确率之间存在怎样的权衡？
• RQ5 所提方法能否检测到现有方法因依赖弱关联而漏检的未知恶意域名？

主要发现

• 所提关联方案通过消除因共享公共IP导致的虚假关联，显著提升了检测准确率，优于共用IP方法。
• 该方案通过识别同一实体控制的域名之间有意义的关联，提升了域名覆盖范围，而现有方法常遗漏此类关联。
• 与信念传播集成后，推理时间显著缩短，可扩展性大幅提升，且与路径推理相比仅造成轻微准确率下降。
• 该方法成功检测到以往常被基于二级域名匹配的方法忽略的恶意动态DNS服务器。
• 在准确率与覆盖范围方面，该方法优于当前最先进方法，尤其在检测具有复杂部署模式的共享基础设施上的域名时表现更优。
• 实证评估证实，在主动DNS数据中区分公共IP与专用IP对于构建可靠的域名关联至关重要。