DNS hijacking

Abstract: The Domain Name System (DNS) is an essential protocol used by both legitimate Internet applications and cyber attacks For example, botnets rely on DNS to support agile command and control infrastructures An effective way to disrupt these attacks is to place malicious domains on a "blocklist" (or "blacklist") or to add a filtering rule in a firewall or network intrusion detection system To evade such security countermeasures, attackers have used DNS agility, eg, by using new domains daily to evade static blacklists and firewalls In this paper we propose Notos, a dynamic reputation system for DNS The premise of this system is that malicious, agile use of DNS has unique characteristics and can be distinguished from legitimate, professionally provisioned DNS services Notos uses passive DNS query data and analyzes the network and zone features of domains It builds models of known legitimate domains and malicious domains, and uses these models to compute a reputation score for a new domain indicative of whether the domain is malicious or legitimate We have evaluated Notos in a large ISP's network with DNS traffic from 14 million users Our results show that Notos can identify malicious domains with high accuracy (true positive rate of 968%) and low false positive rate (038%), and can identify these domains weeks or even months before they appear in public blacklists