The Experts below are selected from a list of 4254 Experts worldwide ranked by ideXlab platform
Xinran Liu - One of the best experts on this subject based on the ideXlab platform.
-
DeepDom: Malicious Domain Detection with Scalable and Heterogeneous Graph Convolutional Networks
Computers & Security, 2020Co-Authors: Xiaoqing Sun, Jiahai Yang, Zhiliang Wang, Xinran LiuAbstract:Abstract As an essential network service, the Domain Name System (DNS) is widely abused by attackers, making Malicious Domain detection a crucial task when combating cybercrimes. The increasing sophistication of attackers calls for new detection methods against novel threats and evasions. In this paper, we analyze the DNS scene and design an intelligent Malicious Domain detection system, named DeepDom. With joint consideration of both Domain’s local features and their global associations, DeepDom is more accurate and is harder for attackers to evade. In DeepDom, we first represent the DNS scene as a Heterogeneous Information Network (HIN) with diverse entities like clients, Domains, IP addresses, and accounts to capture richer information. Then, considering the heterogeneous and dynamic nature of DNS, we propose a novel Graph Convolutional Network (GCN) method named SHetGCN to inductively classify Domain nodes in the HIN. By guiding the convolution operations with meta-path based short random walks, SHetGCN can jointly handle node features together with structural information and support inductive node embedding. We build a prototype of DeepDom and validate its effectiveness with comprehensive experiments over the DNS data collected from a real-world network, CERNET2. The comparison results demonstrate that our approaches outperform other state-of-the-art techniques.
-
learning from time series with outlier correction for Malicious Domain identification
International Symposium on Software Reliability Engineering, 2019Co-Authors: Guolin Tan, Peng Zhang, Lei Zhang, Yu Zhang, Chuang Zhang, Qingyun Liu, Xinran LiuAbstract:Malicious Domain identification is an important task in the field of cyberspace security. However, most of existing work for this task heavily relies on expert experience when constructing machine learning features. What makes matters worse is that these features can be deliberately changed by attackers. As a result, such Malicious Domain identification methods are easily bypassed by cyber criminals. To solve this problem, in this paper, we propose a novel method for Malicious Domain identification by effectively learning time series shapelets, the discriminative local patterns of time series. More specifically, our method consists of two main components: 1) modeling user's habits of accessing Domains by learning shapelets from Domain time series. As the Domain time series is generated by the crowd visiting websites, the learned user's habits of accessing Domains can potentially reflect what type of service a Domain provides, such as pornography, gambling and so on. 2) an outlier correction algorithm designed for a single time series and independent of the model which can enhance the robustness of shapelet initialization. We integrate shapelet learning and outlier correction in our model. Extensive experiments on real-world dataset demonstrates that our proposed method has better performance compared with state-of-the-art methods.
-
ISSRE Workshops - Learning from Time Series with Outlier Correction for Malicious Domain Identification
2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), 2019Co-Authors: Guolin Tan, Peng Zhang, Lei Zhang, Yu Zhang, Chuang Zhang, Qingyun Liu, Xinran LiuAbstract:Malicious Domain identification is an important task in the field of cyberspace security. However, most of existing work for this task heavily relies on expert experience when constructing machine learning features. What makes matters worse is that these features can be deliberately changed by attackers. As a result, such Malicious Domain identification methods are easily bypassed by cyber criminals. To solve this problem, in this paper, we propose a novel method for Malicious Domain identification by effectively learning time series shapelets, the discriminative local patterns of time series. More specifically, our method consists of two main components: 1) modeling user's habits of accessing Domains by learning shapelets from Domain time series. As the Domain time series is generated by the crowd visiting websites, the learned user's habits of accessing Domains can potentially reflect what type of service a Domain provides, such as pornography, gambling and so on. 2) an outlier correction algorithm designed for a single time series and independent of the model which can enhance the robustness of shapelet initialization. We integrate shapelet learning and outlier correction in our model. Extensive experiments on real-world dataset demonstrates that our proposed method has better performance compared with state-of-the-art methods.
-
ICCS (1) - DomainObserver: A Lightweight Solution for Detecting Malicious Domains Based on Dynamic Time Warping
Lecture Notes in Computer Science, 2018Co-Authors: Guolin Tan, Peng Zhang, Qingyun Liu, Xinran Liu, Chunge ZhuAbstract:People use the Internet to shop, access information and enjoy entertainment by browsing web sites. At the same time, cyber-criminals operate Malicious Domains to spread illegal content, which poses a great risk to the security of cyberspace. Therefore, it is of great importance to detect Malicious Domains in the field of cyberspace security. Typically, there are broad research focusing on detecting Malicious Domains either by blacklist or learning the features. However, the former is infeasible due to its unpredictability of unknown Malicious Domains, and the later requires complex feature engineering. Different from most of previous methods, in this paper, we propose a novel lightweight solution named DomainObserver to detect Malicious Domains. Our technique of DomainObserver is based on dynamic time warping that is used to better align the time series. To the best of our knowledge, it is a new trial to apply passive traffic measurements and time series data mining to Malicious Domain detection. Extensive experiments on real datasets are performed to demonstrate the effectiveness of our proposed method.
Yuwei Zeng - One of the best experts on this subject based on the ideXlab platform.
-
malportrait sketch Malicious Domain portraits based on passive dns data
Wireless Communications and Networking Conference, 2020Co-Authors: Zhizhou Liang, Tianning Zang, Yuwei ZengAbstract:Malicious Domain detection is of great significance for cybersecurity. Most prior works detect Malicious Domains based on individual features, which are only related to the attributes of Domains themselves and can be easily changed to avoid detection. To solve the problem, we propose a novel system called MalPortrait, which combines individual features and association information of Domains to detect Malicious Domains. In MalPortrait, we show the association information among Domains by a Domain association graph where vertices represent Domains and edges connect Domains resolved to the same IP. Based on the graph, we combine individual features (e.g., string-based, network-based) of each Domain and its association information to generate new features. Compared with individual features, the new features are harder to be tampered with and can help determine whether a Domain is Malicious from a more comprehensive perspective. We evaluate MalPortrait on the passive DNS traffic collected from real-world large ISP networks. Our experimental results show that MalPortrait can accurately identify Malicious Domain names with a precision of 96.8% and a recall of 95.5%. Compared with prior works, MalPortrait performs better and hardly relies on additional knowledge (e.g., IP reputation, Domain whois).
-
WCNC - MalPortrait: Sketch Malicious Domain Portraits Based on Passive DNS Data
2020 IEEE Wireless Communications and Networking Conference (WCNC), 2020Co-Authors: Zhizhou Liang, Tianning Zang, Yuwei ZengAbstract:Malicious Domain detection is of great significance for cybersecurity. Most prior works detect Malicious Domains based on individual features, which are only related to the attributes of Domains themselves and can be easily changed to avoid detection. To solve the problem, we propose a novel system called MalPortrait, which combines individual features and association information of Domains to detect Malicious Domains. In MalPortrait, we show the association information among Domains by a Domain association graph where vertices represent Domains and edges connect Domains resolved to the same IP. Based on the graph, we combine individual features (e.g., string-based, network-based) of each Domain and its association information to generate new features. Compared with individual features, the new features are harder to be tampered with and can help determine whether a Domain is Malicious from a more comprehensive perspective. We evaluate MalPortrait on the passive DNS traffic collected from real-world large ISP networks. Our experimental results show that MalPortrait can accurately identify Malicious Domain names with a precision of 96.8% and a recall of 95.5%. Compared with prior works, MalPortrait performs better and hardly relies on additional knowledge (e.g., IP reputation, Domain whois).
Lieven Desmet - One of the best experts on this subject based on the ideXlab platform.
-
premadoma an operational solution for dns registries to prevent Malicious Domain registrations
Annual Computer Security Applications Conference, 2019Co-Authors: Jan Spooren, Thomas Vissers, Peter Janssen, Wouter Joosen, Lieven DesmetAbstract:DNS is one of the most essential components of the Internet, mapping Domain names to the IP addresses behind almost every online service. Domain names are therefore also a fundamental tool for attackers to quickly locate and relocate their Malicious activities on the Internet. In this paper, we design and evaluate Premadoma, a solution for DNS registries to predict Malicious intent well before a Domain name becomes operational. In contrast to blacklists, which only offer protection after some harm has already been done, this system can prevent Domain names from being used before they can pose any threats. We advance the state of the art by leveraging recent insights into the ecosystem of Malicious Domain registrations, focusing explicitly on facilitators employed for bulk registration and similarity patterns in registrant information. We thoroughly evaluate the proposed prediction model's performance and adaptability on an 11 month testing set, and address complex and Domain-specific dataset challenges. Moreover, we have successfully deployed Premadoma in the production environment of the .eu ccTLD registry to detect and prevent Malicious registrations, and have contributed to the take down of 58,966 registrations in 2018.
-
ACSAC - Premadoma: an operational solution for DNS registries to prevent Malicious Domain registrations
Proceedings of the 35th Annual Computer Security Applications Conference, 2019Co-Authors: Jan Spooren, Thomas Vissers, Peter Janssen, Wouter Joosen, Lieven DesmetAbstract:DNS is one of the most essential components of the Internet, mapping Domain names to the IP addresses behind almost every online service. Domain names are therefore also a fundamental tool for attackers to quickly locate and relocate their Malicious activities on the Internet. In this paper, we design and evaluate Premadoma, a solution for DNS registries to predict Malicious intent well before a Domain name becomes operational. In contrast to blacklists, which only offer protection after some harm has already been done, this system can prevent Domain names from being used before they can pose any threats. We advance the state of the art by leveraging recent insights into the ecosystem of Malicious Domain registrations, focusing explicitly on facilitators employed for bulk registration and similarity patterns in registrant information. We thoroughly evaluate the proposed prediction model's performance and adaptability on an 11 month testing set, and address complex and Domain-specific dataset challenges. Moreover, we have successfully deployed Premadoma in the production environment of the .eu ccTLD registry to detect and prevent Malicious registrations, and have contributed to the take down of 58,966 registrations in 2018.
-
RAID - Exploring the Ecosystem of Malicious Domain Registrations in the .eu TLD
Research in Attacks Intrusions and Defenses, 2017Co-Authors: Thomas Vissers, Jan Spooren, Peter Janssen, Wouter Joosen, Pieter Agten, Dirk Jumpertz, Marc Van Wesemael, Frank Piessens, Lieven DesmetAbstract:This study extensively scrutinizes 14 months of registration data to identify large-scale Malicious campaigns present in the .eu TLD. We explore the ecosystem and modus operandi of elaborate cybercriminal entities that recurrently register large amounts of Domains for one-shot, Malicious use. Although these Malicious Domains are short-lived, by incorporating registrant information, we establish that at least 80.04% of them can be framed in to 20 larger campaigns with varying duration and intensity. We further report on insights in the operational aspects of this business and observe, amongst other findings, that their processes are only partially automated. Finally, we apply a post-factum clustering process to validate the campaign identification process and to automate the ecosystem analysis of Malicious registrations in a TLD zone.
-
exploring the ecosystem of Malicious Domain registrations in the eu tld
Recent Advances in Intrusion Detection, 2017Co-Authors: Thomas Vissers, Jan Spooren, Peter Janssen, Wouter Joosen, Pieter Agten, Dirk Jumpertz, Marc Van Wesemael, Frank Piessens, Lieven DesmetAbstract:This study extensively scrutinizes 14 months of registration data to identify large-scale Malicious campaigns present in the .eu TLD. We explore the ecosystem and modus operandi of elaborate cybercriminal entities that recurrently register large amounts of Domains for one-shot, Malicious use. Although these Malicious Domains are short-lived, by incorporating registrant information, we establish that at least 80.04% of them can be framed in to 20 larger campaigns with varying duration and intensity. We further report on insights in the operational aspects of this business and observe, amongst other findings, that their processes are only partially automated. Finally, we apply a post-factum clustering process to validate the campaign identification process and to automate the ecosystem analysis of Malicious registrations in a TLD zone.
Guolin Tan - One of the best experts on this subject based on the ideXlab platform.
-
learning from time series with outlier correction for Malicious Domain identification
International Symposium on Software Reliability Engineering, 2019Co-Authors: Guolin Tan, Peng Zhang, Lei Zhang, Yu Zhang, Chuang Zhang, Qingyun Liu, Xinran LiuAbstract:Malicious Domain identification is an important task in the field of cyberspace security. However, most of existing work for this task heavily relies on expert experience when constructing machine learning features. What makes matters worse is that these features can be deliberately changed by attackers. As a result, such Malicious Domain identification methods are easily bypassed by cyber criminals. To solve this problem, in this paper, we propose a novel method for Malicious Domain identification by effectively learning time series shapelets, the discriminative local patterns of time series. More specifically, our method consists of two main components: 1) modeling user's habits of accessing Domains by learning shapelets from Domain time series. As the Domain time series is generated by the crowd visiting websites, the learned user's habits of accessing Domains can potentially reflect what type of service a Domain provides, such as pornography, gambling and so on. 2) an outlier correction algorithm designed for a single time series and independent of the model which can enhance the robustness of shapelet initialization. We integrate shapelet learning and outlier correction in our model. Extensive experiments on real-world dataset demonstrates that our proposed method has better performance compared with state-of-the-art methods.
-
ISSRE Workshops - Learning from Time Series with Outlier Correction for Malicious Domain Identification
2019 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), 2019Co-Authors: Guolin Tan, Peng Zhang, Lei Zhang, Yu Zhang, Chuang Zhang, Qingyun Liu, Xinran LiuAbstract:Malicious Domain identification is an important task in the field of cyberspace security. However, most of existing work for this task heavily relies on expert experience when constructing machine learning features. What makes matters worse is that these features can be deliberately changed by attackers. As a result, such Malicious Domain identification methods are easily bypassed by cyber criminals. To solve this problem, in this paper, we propose a novel method for Malicious Domain identification by effectively learning time series shapelets, the discriminative local patterns of time series. More specifically, our method consists of two main components: 1) modeling user's habits of accessing Domains by learning shapelets from Domain time series. As the Domain time series is generated by the crowd visiting websites, the learned user's habits of accessing Domains can potentially reflect what type of service a Domain provides, such as pornography, gambling and so on. 2) an outlier correction algorithm designed for a single time series and independent of the model which can enhance the robustness of shapelet initialization. We integrate shapelet learning and outlier correction in our model. Extensive experiments on real-world dataset demonstrates that our proposed method has better performance compared with state-of-the-art methods.
-
ICCS (1) - DomainObserver: A Lightweight Solution for Detecting Malicious Domains Based on Dynamic Time Warping
Lecture Notes in Computer Science, 2018Co-Authors: Guolin Tan, Peng Zhang, Qingyun Liu, Xinran Liu, Chunge ZhuAbstract:People use the Internet to shop, access information and enjoy entertainment by browsing web sites. At the same time, cyber-criminals operate Malicious Domains to spread illegal content, which poses a great risk to the security of cyberspace. Therefore, it is of great importance to detect Malicious Domains in the field of cyberspace security. Typically, there are broad research focusing on detecting Malicious Domains either by blacklist or learning the features. However, the former is infeasible due to its unpredictability of unknown Malicious Domains, and the later requires complex feature engineering. Different from most of previous methods, in this paper, we propose a novel lightweight solution named DomainObserver to detect Malicious Domains. Our technique of DomainObserver is based on dynamic time warping that is used to better align the time series. To the best of our knowledge, it is a new trial to apply passive traffic measurements and time series data mining to Malicious Domain detection. Extensive experiments on real datasets are performed to demonstrate the effectiveness of our proposed method.
Zhizhou Liang - One of the best experts on this subject based on the ideXlab platform.
-
malportrait sketch Malicious Domain portraits based on passive dns data
Wireless Communications and Networking Conference, 2020Co-Authors: Zhizhou Liang, Tianning Zang, Yuwei ZengAbstract:Malicious Domain detection is of great significance for cybersecurity. Most prior works detect Malicious Domains based on individual features, which are only related to the attributes of Domains themselves and can be easily changed to avoid detection. To solve the problem, we propose a novel system called MalPortrait, which combines individual features and association information of Domains to detect Malicious Domains. In MalPortrait, we show the association information among Domains by a Domain association graph where vertices represent Domains and edges connect Domains resolved to the same IP. Based on the graph, we combine individual features (e.g., string-based, network-based) of each Domain and its association information to generate new features. Compared with individual features, the new features are harder to be tampered with and can help determine whether a Domain is Malicious from a more comprehensive perspective. We evaluate MalPortrait on the passive DNS traffic collected from real-world large ISP networks. Our experimental results show that MalPortrait can accurately identify Malicious Domain names with a precision of 96.8% and a recall of 95.5%. Compared with prior works, MalPortrait performs better and hardly relies on additional knowledge (e.g., IP reputation, Domain whois).
-
WCNC - MalPortrait: Sketch Malicious Domain Portraits Based on Passive DNS Data
2020 IEEE Wireless Communications and Networking Conference (WCNC), 2020Co-Authors: Zhizhou Liang, Tianning Zang, Yuwei ZengAbstract:Malicious Domain detection is of great significance for cybersecurity. Most prior works detect Malicious Domains based on individual features, which are only related to the attributes of Domains themselves and can be easily changed to avoid detection. To solve the problem, we propose a novel system called MalPortrait, which combines individual features and association information of Domains to detect Malicious Domains. In MalPortrait, we show the association information among Domains by a Domain association graph where vertices represent Domains and edges connect Domains resolved to the same IP. Based on the graph, we combine individual features (e.g., string-based, network-based) of each Domain and its association information to generate new features. Compared with individual features, the new features are harder to be tampered with and can help determine whether a Domain is Malicious from a more comprehensive perspective. We evaluate MalPortrait on the passive DNS traffic collected from real-world large ISP networks. Our experimental results show that MalPortrait can accurately identify Malicious Domain names with a precision of 96.8% and a recall of 95.5%. Compared with prior works, MalPortrait performs better and hardly relies on additional knowledge (e.g., IP reputation, Domain whois).