Paper Info
Title
MD-Miner: Behavior-Based Tracking of Network Traffic for Malware-Control Domain Detection
Abstract
Malicious domains are basic tools in the hands of cyber criminals. Once a victim is malware-infected, malware will tend to connect malicious domains to do internet crime such as awaiting the remote control command or delivering the malware reported feedback. Recent studies have paid much effort on detecting malicious domains, but still have room to improve. For the purpose of detecting malicious domains efficiently and accurately, we propose MD-Miner, a novel scalable system that tracks new malicious domains in large-volume of network traffic data. MD-Miner monitors the network traffic to build a process domain bipartite graph representing who is connecting what. After labeling nodes in this process-domain graph that are known to be either benign or malicious-related, we propose a novel approach to accurately detect previously unknown malicious domains. In this paper, we implemented a proof-of-concept version of MD-Miner with assistance of Map Reduce architecture. The experiment results show that MD-Miner can achieve AUC as good as 95% and find new malicious domain which cannot be identified by other reputation system. In addition, the scalability and applicability of MD-Miner is demonstrated by experiments on the real-world enterprise network traffic.
Year
DOI
Venue
2017
10.1109/BigDataService.2017.16
2017 IEEE Third International Conference on Big Data Computing Service and Applications (BigDataService)
Keywords
Field
DocType
APT,botnet,MapReduce
Data mining,Cryptovirology,Reputation system,Computer science,Server,Bipartite graph,Feature extraction,Malware,Enterprise private network,Scalability
Conference
ISBN
Citations 
PageRank 
978-1-5090-6319-2
2
0.38
References 
Authors
10
5
Name
Order
Citations
PageRank
Jia-Hao Sun120.38
Tzung-Han Jeng221.74
Chien-Chih Chen311120.42
Hsiu-Chuan Huang4122.43
Kuo-Sen Chou562.10