Detecting Malware Based on DNS Graph Mining
Malware remains a major threat to nowadays Internet. In this paper, we propose a DNS graph mining-based malware detection approach. A DNS graph is composed of DNS nodes, which represent server IPs, client IPs, and queried domain names in the process of DNS resolution. After the graph construction, w...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Hindawi - SAGE Publishing
2015-10-01
|
| Series: | International Journal of Distributed Sensor Networks |
| Online Access: | https://doi.org/10.1155/2015/102687 |
| _version_ | 1797712101609832448 |
|---|---|
| author | Futai Zou Siyu Zhang Weixiong Rao Ping Yi |
| author_facet | Futai Zou Siyu Zhang Weixiong Rao Ping Yi |
| author_sort | Futai Zou |
| collection | DOAJ |
| description | Malware remains a major threat to nowadays Internet. In this paper, we propose a DNS graph mining-based malware detection approach. A DNS graph is composed of DNS nodes, which represent server IPs, client IPs, and queried domain names in the process of DNS resolution. After the graph construction, we next transform the problem of malware detection to the graph mining task of inferring graph nodes' reputation scores using the belief propagation algorithm. The nodes with lower reputation scores are inferred as those infected by malwares with higher probability. For demonstration, we evaluate the proposed malware detection approach with real-world dataset. Our real-world dataset is collected from campus DNS servers for three months and we built a DNS graph consisting of 19,340,820 vertices and 24,277,564 edges. On the graph, we achieve a true positive rate 80.63% with a false positive rate 0.023%. With a false positive of 1.20%, the true positive rate was improved to 95.66%. We detected 88,592 hosts infected by malware or C&C servers, accounting for the percentage of 5.47% among all hosts. Meanwhile, 117,971 domains are considered to be related to malicious activities, accounting for 1.5% among all domains. The results indicate that our method is efficient and effective in detecting malwares. |
| first_indexed | 2024-03-12T07:16:49Z |
| format | Article |
| id | doaj.art-0ebfcfe0ac924ebe8dc8f38b5a5531c1 |
| institution | Directory Open Access Journal |
| issn | 1550-1477 |
| language | English |
| last_indexed | 2024-03-12T07:16:49Z |
| publishDate | 2015-10-01 |
| publisher | Hindawi - SAGE Publishing |
| record_format | Article |
| series | International Journal of Distributed Sensor Networks |
| spelling | doaj.art-0ebfcfe0ac924ebe8dc8f38b5a5531c12023-09-02T22:43:14ZengHindawi - SAGE PublishingInternational Journal of Distributed Sensor Networks1550-14772015-10-011110.1155/2015/102687102687Detecting Malware Based on DNS Graph MiningFutai Zou0Siyu Zhang1Weixiong Rao2Ping Yi3 School of Information Security Engineering, Shanghai Jiao Tong University, Shanghai 200240, China Network and Information Center, Shanghai Jiao Tong University, Shanghai 200240, China School of Software Engineering, Tongji University, Shanghai 201804, China School of Information Security Engineering, Shanghai Jiao Tong University, Shanghai 200240, ChinaMalware remains a major threat to nowadays Internet. In this paper, we propose a DNS graph mining-based malware detection approach. A DNS graph is composed of DNS nodes, which represent server IPs, client IPs, and queried domain names in the process of DNS resolution. After the graph construction, we next transform the problem of malware detection to the graph mining task of inferring graph nodes' reputation scores using the belief propagation algorithm. The nodes with lower reputation scores are inferred as those infected by malwares with higher probability. For demonstration, we evaluate the proposed malware detection approach with real-world dataset. Our real-world dataset is collected from campus DNS servers for three months and we built a DNS graph consisting of 19,340,820 vertices and 24,277,564 edges. On the graph, we achieve a true positive rate 80.63% with a false positive rate 0.023%. With a false positive of 1.20%, the true positive rate was improved to 95.66%. We detected 88,592 hosts infected by malware or C&C servers, accounting for the percentage of 5.47% among all hosts. Meanwhile, 117,971 domains are considered to be related to malicious activities, accounting for 1.5% among all domains. The results indicate that our method is efficient and effective in detecting malwares.https://doi.org/10.1155/2015/102687 |
| spellingShingle | Futai Zou Siyu Zhang Weixiong Rao Ping Yi Detecting Malware Based on DNS Graph Mining International Journal of Distributed Sensor Networks |
| title | Detecting Malware Based on DNS Graph Mining |
| title_full | Detecting Malware Based on DNS Graph Mining |
| title_fullStr | Detecting Malware Based on DNS Graph Mining |
| title_full_unstemmed | Detecting Malware Based on DNS Graph Mining |
| title_short | Detecting Malware Based on DNS Graph Mining |
| title_sort | detecting malware based on dns graph mining |
| url | https://doi.org/10.1155/2015/102687 |
| work_keys_str_mv | AT futaizou detectingmalwarebasedondnsgraphmining AT siyuzhang detectingmalwarebasedondnsgraphmining AT weixiongrao detectingmalwarebasedondnsgraphmining AT pingyi detectingmalwarebasedondnsgraphmining |