DNS Enhancement Catches Malware Websites by Understanding Sneaky Domain Names

A Researcher at OpenDNS Security Labs, has Developed a New Way to Automatically Detect and Block Sites Used to Distribute Malware almost Instantaneously without Having to Scan them. The Approach, Initially Developed by Researcher, Jeremiah O'Connor, Uses Natural Language Processing and Other Analytics, to Detect Malicious Domains before they Can Attack by Spotting Host Names that are Designed as Camouflage. Called, 'NLPRank', it Spots DNS Requests for Websites that Have Names Similar to Legitimate Sites but, with IP Addresses that are Outside the Expected Address Blocks and Other Related Data that Hints at Sketchiness. The Practice of Using Look-Alike Domain Names as Part of an Effort to Fool Victims into Visiting Websites or Approving Downloads is a Well-Worn Approach in Computer Crime. But, Recent Crafted Attacks via "Phishing" Links in Emails and Social Media, Have Gone Past the Well-Worn "Typo-Squatting" Approach by Using Domain Names that Appear Close to those of Trusted Websites, Registered just in Time for Attacks to Fly under Reputation-Scoring Security Tools, to Make Blacklisting them Harder.


Fake Domain Names such as Update-Java.net and Adobe-Update.net, for example, were Used in the Recently Discovered "Carbanak" Attacks on Banks that Allowed Criminals to Gain Access to Financial Institutions' Networks, Starting in January 2013 and Steal over $1 Billion over the Next 2 Years. Many Security Services Can Screen Out Malicious Websites based on Techniques such as Reputation Analysis — Checking a Centralized Database to See if a Site Name has been Associated with any Malware Attacks. But, because Attackers are Able to Rapidly Register New Domains with Scripted Systems that Look relatively Legitimate to the Average Computer User, they Can Often Bypass Reputation Checks — Especially When Using their Specially Crafted Domain Names in Highly Targeted Attacks. O'Connor's Approach, which is currently Being Tested by OpenDNS Using Live DNS Query Traffic, Gets Around the Reputation Problem by Simply Analyzing the Domain Name itself for Sketchiness.


It Works in a Way Similar to Natural Language Processing of any Stream of Text Content. Using Patterns Spotted in Malicious DNS Traffic, OpenDNS Security Researchers are Training the NLPRank System to Identify Domain Names that Look Similar to Legitimate Websites but, Have Attributes that, Flag them as Being Suspicious. "Essentially what we are defining is a 'malicious language' within the lexical nature of DNS traffic", O'Connor Wrote in a Blog Post being Published this Morning. The "Language" Consists of Domain Names that are Combinations of Technology Company-Related Text (such as "java", "gmail", "facebook", or "adobe", for Example with a Collection of "certain dictionary words", O'Connor Explained ("install", "update", "security", or "payment", for instance). The System then Performs "sentiment analysis" on Frequently Queried Domain Names in 10s of Billions of DNS Requests, that Flow through OpenDNS Daily, Looking for Patterns like these, Applying a Set of Ranking Scores to Domain Names that Match the Pattern.


"If it's a Facebook-related domain and not associated with Facebook's IP address space, that would be a negative tick", Said Andrew Hay, Director of Security Research at OpenDNS, in an Interview. "Or if it was registered a day ago and administered by someone with a Russian disposable e-mail address, those would be negatives." And the System Can also do HTML Analysis of Websites Associated with the Domain Names, to Check if there's a Match. "We can look at fraud websites and compare them to actual legitimate pages, see how much they differ", Hay Explained. Hay Said that, OpenDNS is currently Fine-Tuning the System to Prevent False Positives but that, so Far NLPRank has Held Up Well in Testing. "We have used it to detect malicious phishing campaigns", he Said. "And we've been able to use it to validate data in other security firms' reports, giving us additional reinforcement that it's working."




Info Source:

https://labs.opendns.com/2015/03/05/nlp-apt-dns