首页> 外文期刊>ACM Computing Surveys >A Survey on Malicious Domains Detection through DNS Data Analysis
【24h】

A Survey on Malicious Domains Detection through DNS Data Analysis

机译:通过DNS数据分析进行恶意域检测的调查

获取原文
获取原文并翻译 | 示例
       

摘要

Malicious domains are one of the major resources required for adversaries to run attacks over the Internet. Due to the important role of the Domain Name System (DNS), extensive research has been conducted to identify malicious domains based on their unique behavior reflected in different phases of the life cycle of DNS queries and responses. Existing approaches differ significantly in terms of intuitions, data analysis methods as well as evaluation methodologies. This warrants a thorough systematization of the approaches and a careful review of the advantages and limitations of every group.In this article, we perform such an analysis. To achieve this goal, we present the necessary background knowledge on DNS and malicious activities leveraging DNS. We describe a general framework of malicious domain detection techniques using DNS data. Applying this framework, we categorize existing approaches using several orthogonal viewpoints, namely (1) sources of DNS data and their enrichment, (2) data analysis methods, and (3) evaluation strategies and metrics. In each aspect, we discuss the important challenges that the research community should address in order to fully realize the power of DNS data analysis to fight against attacks leveraging malicious domains.
机译:恶意域是攻击者通过Internet进行攻击所需的主要资源之一。由于域名系统(DNS)的重要作用,已经进行了广泛的研究,以根据在DNS查询和响应的生命周期的不同阶段反映出的恶意域,来识别恶意域。现有的方法在直觉,数据分析方法以及评估方法方面都存在很大差异。这需要对方法进行彻底的系统化,并仔细检查每个组的优点和缺点。在本文中,我们进行了这样的分析。为了实现此目标,我们提供了有关DNS和利用DNS的恶意活动的必要背景知识。我们描述了使用DNS数据的恶意域检测技术的一般框架。应用此框架,我们使用几种正交的观点对现有方法进行分类,即(1)DNS数据的来源及其丰富,(2)数据分析方法以及(3)评估策略和指标。在每个方面,我们都讨论了研究社区应解决的重要挑战,以便充分实现DNS数据分析的功能来对抗利用恶意域的攻击。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱:kefu@zhangqiaokeyan.com

京公网安备:11010802029741号 ICP备案号:京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有
  • 客服微信

  • 服务号