{"id":1087,"date":"2017-10-24T13:51:07","date_gmt":"2017-10-24T20:51:07","guid":{"rendered":"https:\/\/ant.isi.edu\/blog\/?p=1087"},"modified":"2020-10-14T15:50:53","modified_gmt":"2020-10-14T22:50:53","slug":"__trashed","status":"publish","type":"post","link":"https:\/\/ant.isi.edu\/blog\/?p=1087","title":{"rendered":"new journal paper \u201cDetecting Malicious Activity With DNS Backscatter Over Time\u201d in IEEE\/ACM ToN Oct, 2017"},"content":{"rendered":"<p>The paper <a href=\"http:\/\/ieeexplore.ieee.org\/document\/8000668\/\">\u201cDetecting Malicious Activity With DNS Backscatter Over Time&nbsp;\u201d<\/a> appears in EEE\/ACM&nbsp; Transactions on Networking ( Volume: 25, Issue: 5, Oct. 2017 ).<\/p>\n<p>From the abstract:<\/p>\n<p><em>Network-wide activity is when one computer (the&nbsp;<\/em><em>originator) touches many others (the targets). Motives for activity&nbsp;<\/em><em>may be benign (mailing lists, CDNs, and research scanning),&nbsp;<\/em><em>malicious (spammers and scanners for security vulnerabilities),&nbsp;<\/em><em>or perhaps indeterminate (ad trackers). Knowledge of malicious&nbsp;<\/em><em>activity may help anticipate attacks, and understanding benign&nbsp;<\/em><em>activity may set a baseline or characterize growth. This paper&nbsp;<\/em><em>identifies DNS backscatter as a new source of information about&nbsp;<\/em><em>network-wide activity. Backscatter is the reverse DNS queries&nbsp;<\/em><em>caused when targets or middleboxes automatically look up&nbsp;<\/em><em>the domain name of the originator. Queries are visible to the&nbsp;<\/em><em>authoritative DNS servers that handle reverse DNS. While the&nbsp;<\/em><em>fraction of backscatter they see depends on the server\u2019s location&nbsp;<\/em><em>in the DNS hierarchy, we show that activity that touches many&nbsp;<\/em><em>targets appear even in sampled observations. We use information&nbsp;<\/em><em>about the queriers to classify originator activity using machine learning.&nbsp;<\/em><em>Our algorithm has reasonable accuracy and precision&nbsp;<\/em><em>(70\u201380%) as shown by data from three different organizations&nbsp;<\/em><em>operating DNS servers at the root or country-level. Using this&nbsp;<\/em><em>technique we examine nine months of activity from one authority&nbsp;<\/em><em>to identify trends in scanning, identifying bursts corresponding&nbsp;<\/em><em>to Heartbleed and broad and continuous scanning of ssh.<\/em><\/p>\n<p><a href=\"https:\/\/ant.isi.edu\/blog\/wp-content\/uploads\/2017\/10\/fig5_6.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-1093 size-large\" src=\"https:\/\/ant.isi.edu\/blog\/wp-content\/uploads\/2017\/10\/fig5_6-1024x412.png\" alt=\"\" width=\"640\" height=\"258\" srcset=\"https:\/\/ant.isi.edu\/blog\/wp-content\/uploads\/2017\/10\/fig5_6-1024x412.png 1024w, https:\/\/ant.isi.edu\/blog\/wp-content\/uploads\/2017\/10\/fig5_6-300x121.png 300w, https:\/\/ant.isi.edu\/blog\/wp-content\/uploads\/2017\/10\/fig5_6-768x309.png 768w, https:\/\/ant.isi.edu\/blog\/wp-content\/uploads\/2017\/10\/fig5_6.png 1364w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>This paper furthers our understanding of evolution of malicious network activities from an earlier work that:<br \/>\n(1) Why our machine-learning based classifier (that relies on manually collected labeled data) does not port across physical sites and over time.<br \/>\n(2) Secondly paper recommends how to sustain good learning score over time and provides expected life-time of labeled data.<\/p>\n<p>An excerpt from section III-E (Training Over Time):<\/p>\n<p><em>Classification (\u00a7 III-D) is based on training, yet training accuracy is affected by the evolution of activity\u2014specific examples come and go, and the behavior in each class evolves. Change happens for all classes, but the problem is particularly acute for malicious classes (such as spam) where the adversarial nature of the action forces rapid evolution (see \u00a7 V).<\/em><\/p>\n<p>&nbsp;<\/p>\n<p>Some datasets used in this paper can be found <a href=\"https:\/\/ant.isi.edu\/datasets\/dns_backscatter\/index.html\">here<\/a>:<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The paper \u201cDetecting Malicious Activity With DNS Backscatter Over Time&nbsp;\u201d appears in EEE\/ACM&nbsp; Transactions on Networking ( Volume: 25, Issue: 5, Oct. 2017 ). From the abstract: Network-wide activity is when one computer (the&nbsp;originator) touches many others (the targets). Motives for activity&nbsp;may be benign (mailing lists, CDNs, and research scanning),&nbsp;malicious (spammers and scanners for security [&hellip;]<\/p>\n","protected":false},"author":634,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[289,284,282],"tags":[132,63],"class_list":["post-1087","post","type-post","status-publish","format-standard","hentry","category-dns","category-papers-publications","category-publications","tag-backscatter","tag-dns"],"_links":{"self":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/users\/634"}],"replies":[{"embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1087"}],"version-history":[{"count":7,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1087\/revisions"}],"predecessor-version":[{"id":1584,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1087\/revisions\/1584"}],"wp:attachment":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}