COMAR: Classification of Compromised versus Maliciously Registered Domains - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

COMAR: Classification of Compromised versus Maliciously Registered Domains

Résumé

Miscreants abuse thousands of domain names every day by launching large-scale attacks such as phishing or malware campaigns. While some domains are solely registered for malicious purposes, others are benign but get compromised and misused to serve malicious content. Existing methods for their detection can either predict malicious domains at the time of registration or identify indicators of an ongoing malicious activity conflating maliciously registered and compromised domains into common blacklists. Since the mitigation actions for these two types domains are different, we propose COMAR, an approach to differentiate between compromised and maliciously registered domains, complementary to previously proposed domain reputation systems. We start the paper with a thorough analysis of the domain life cycle to determine the relationship between each step and define its associated features. COMAR uses a set of 38 features costly to evade. We evaluate COMAR using phishing and malware blacklists and show that it can achieve high accuracy (97% accuracy with a 2.5% false-positive rate) without using any privileged or non-publicly available data, which makes it suitable for the use by any organization. We plan to deploy COMAR at two domain registry operators of the European country-code TLDs and set up an early notification system to facilitate the remediation of blacklisted domains.
Fichier non déposé

Dates et versions

hal-03274964 , version 1 (30-06-2021)

Identifiants

Citer

Sourena Maroofi, Maciej Korczynski, Cristian Hesselman, Benoit Ampeau, Andrzej Duda. COMAR: Classification of Compromised versus Maliciously Registered Domains. 2020 IEEE European Symposium on Security and Privacy (EuroS&P), Sep 2020, Genoa, Italy. pp.607-623, ⟨10.1109/EuroSP48549.2020.00045⟩. ⟨hal-03274964⟩
42 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More