Heuristic Methods for Efficient Identification of Abusive Domain Names
Egon Kidmose, Erwin Lansing, Søren Brandbyge, Jens Myrup Pedersen · International Journal on Cyber Situational Awareness · 2018
Domain names and the Domain Name System (DNS) are essential to theInternet, but unfortunately cyber-criminals also make use of these to fulfil their nefarious agenda and gain illicit profit.In this work we survey known forms of domain and DNS abuse from the criminal business point of view.We relate this to abusive techniques, which we also survey.Based on the theoretical understanding of the abusive techniques, we devise a set of practical heuristics for recognising said techniques.This enables a focused and efficient manual analysis of heuristically ranked domains, with the goal of identifying abusive domains.As the .dkCountry Code Top-Level Domain has received little scrutiny in the past, but is believed to see only limited abuse, it represents a relevant and presumably challenging case for identifying abuse, and we therefore use it for evaluation.WHOIS data is collected for 10.000 second level domains for 66 days, heuristics are applied, and the resulting rankings guide a manual vetting.Our findings are that with automated heuristics we can limit the manual investigative effort to hours, and still identify 5 domains which are actively abused during our observation period.