Name
Title | ||
|---|---|---|
Correlating file-based malware graphs against the empirical ground truth of DNS graphs. |
Abstract | ||
|---|---|---|
This exploratory empirical paper investigates whether the sharing of unique malware files between domains is empirically associated with the sharing of Internet Protocol (IP) addresses and the sharing of normal, non-malware files. By utilizing a graph theoretical approach with a web crawling dataset from F-Secure, the paper finds no robust statistical associations, however. Unlike what might be expected from the still continuing popularity of shared hosting services, the sharing of IP addresses through the domain name system (DNS) seems to neither increase nor decrease the sharing of malware files. In addition to these exploratory empirical results, the paper contributes to the field of DNS mining by elaborating graph theoretical representations that are applicable for analyzing different network forensics problems. |
Year | DOI | Venue |
|---|---|---|
2016 | 10.1145/2993412.2993414 | ECSA Workshops |
Keywords | Field | DocType |
DNS mining,shared hosting,network forensics,complex network analysis,ground truth problem,cyber security | Internet Protocol,Internet hosting service,World Wide Web,Information retrieval,Network forensics,Computer science,Domain Name System,Popularity,Real-time computing,Ground truth,Malware,Web crawler | Conference |
Citations | PageRank | References |
1 | 0.36 | 7 |
Authors | ||
6 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Jukka Ruohonen | 1 | 55 | 13.05 |
| Sanja Scepanovic | 2 | 5 | 2.79 |
| Sami Hyrynsalmi | 3 | 145 | 32.53 |
| Igor Mishkovski | 4 | 1 | 0.36 |
| Tuomas Aura | 5 | 552 | 77.28 |
| Ville Leppänen | 6 | 240 | 56.53 |