Computing domains reputation using flow
Igor Mishsky, Nurit Gal-Oz, Ehud Gudes · 2014
The Domain Name System (DNS) is an essential component of the Internet infrastructure that translates domain names into IP addresses. Recent incidents verify the enormous damage of malicious activities utilizing DNS. Therefore, detecting malicious domains using the DNS network structure is an important challenge. We take the famous colloquial expression Tell me who your friends are and I will tell you who you are, motivating many social trust models, to the Internet domains world. We assert that a domain that is related to malicious domains is more likely to be malicious as well, and malicious domains may be identified by analyzing cross domains relationships. The term domain reputation represents the extent to which we consider a domain as malicious. In this paper we present a new approach for computing domain reputation by applying a flow algorithm on a DNS based graph. The experimental evaluation of the flow algorithm demonstrates significant success in predicting malicious domains.