Identifying APT Malware Domain Based on Mobile DNS Logging
Joint Authors
Niu, Weina
Zhang, Xiaosong
Zhu, Jianan
Ren, Zhongwei
Yang, Guowu
Source
Mathematical Problems in Engineering
Issue
Vol. 2017, Issue 2017 (31 Dec. 2017), pp.1-9, 9 p.
Publisher
Hindawi Publishing Corporation
Publication Date
2017-04-06
Country of Publication
Egypt
No. of Pages
9
Main Subjects
Abstract EN
Advanced Persistent Threat (APT) is a serious threat against sensitive information.
Current detection approaches are time-consuming since they detect APT attack by in-depth analysis of massive amounts of data after data breaches.
Specifically, APT attackers make use of DNS to locate their command and control (C&C) servers and victims’ machines.
In this paper, we propose an efficient approach to detect APT malware C&C domain with high accuracy by analyzing DNS logs.
We first extract 15 features from DNS logs of mobile devices.
According to Alexa ranking and the VirusTotal’s judgement result, we give each domain a score.
Then, we select the most normal domains by the score metric.
Finally, we utilize our anomaly detection algorithm, called Global Abnormal Forest (GAF), to identify malware C&C domains.
We conduct a performance analysis to demonstrate that our approach is more efficient than other existing works in terms of calculation efficiency and recognition accuracy.
Compared with Local Outlier Factor (LOF), k-Nearest Neighbor (KNN), and Isolation Forest (iForest), our approach obtains more than 99% F-M and R for the detection of C&C domains.
Our approach not only can reduce data volume that needs to be recorded and analyzed but also can be applicable to unsupervised learning.
American Psychological Association (APA)
Niu, Weina& Zhang, Xiaosong& Yang, Guowu& Zhu, Jianan& Ren, Zhongwei. 2017. Identifying APT Malware Domain Based on Mobile DNS Logging. Mathematical Problems in Engineering،Vol. 2017, no. 2017, pp.1-9.
https://search.emarefa.net/detail/BIM-1190539
Modern Language Association (MLA)
Niu, Weina…[et al.]. Identifying APT Malware Domain Based on Mobile DNS Logging. Mathematical Problems in Engineering No. 2017 (2017), pp.1-9.
https://search.emarefa.net/detail/BIM-1190539
American Medical Association (AMA)
Niu, Weina& Zhang, Xiaosong& Yang, Guowu& Zhu, Jianan& Ren, Zhongwei. Identifying APT Malware Domain Based on Mobile DNS Logging. Mathematical Problems in Engineering. 2017. Vol. 2017, no. 2017, pp.1-9.
https://search.emarefa.net/detail/BIM-1190539
Data Type
Journal Articles
Language
English
Notes
Includes bibliographical references
Record ID
BIM-1190539