DNS Data Science!
!
Internet Week, Tokyo Japan !

Bruce Van Nice!
Nominum!

1!

About Nominum!
• Paul Mockapetris!
• Engineers architected BIND 9!
• Deployed in over 40 countries!
• Used by >400M subscribers daily!
• Processes >1.8 trillion transactions daily!
!

2!

About Me !
• Director of Product Marketing at Nominum!
• Focus on DNS security!
• Active participant at industry events!
• About 30 years in networking industry!

3!

Why Do DNS Data Research? !

• Existing threat analysis isn’t good enough!
– No coverage of DNS DDoS!
– Poor coverage of bots and malware!

• Existing feeds have limitations:!
– Unacceptably high false positive rates!
– Unacceptable for providers!

• Combining feeds didn't help!

BAD + BAD =/! GOOD!!
4!

DNS Data Science!
Discovering patterns and relationships• > 3.5 Terabytes/data/day!
• Est ~3% of ISP DNS traffic!

Data is anonymized to protect privacy
5!

Correlation Technology!
•Machine learning - search for similarities!
––•

sfgiants.com google.com redsox.com mlb.com
facebook.com…!
botnet_cnc1.com google.com botnet_cnc2.biz
facebook.com yahoo.com botnet_cnc3.ru!

Visualization groups similar domains together!

Correlation technology finds moremalware faster!
Uncovers other relationships different apps infected with samemalware!
6!

Example: New Core Domains !

DNS data:
3.5 million
In almost real-time!

List 1:
9.8 thousand

Mostly DGAs
Most are malicious
Some don’t resolve

List 2:
9.1 thousand

List 3:
6.0 thousand

Reported onother lists over
27 daysExample: “Clusters Detected” !
1"
0.9"
0.8"

Nom0Rank"

0.7"
0.6"
0.5"
0.4"

Lifespan of a typical domain inthese clusters < 3 days!

0.3"
0.2"
0.1"
0"
1" 2" 3" 4" 5" 6" 7" 8" 9" 10" 11" 12" 13" 14" 15" 16" 17" 18" 19" 20" 21" 22" 23" 24" 25" 26" 27" 28" 29" 30"Days"a8er"detec>on"10000:"Malicious"browser0hijacking"code"which"displays"unwanted"ads"10002:"Cluster"of"malware/adware"domains"used"by"hijacked"web"browsers."
10001:"Cluster"of"suspected"botnet"command0and0control"domains."
10003:"Cluster"of"suspected"botnet"command0and0control"domains."

8!

Example: Browser Hijacking!

••••

Example Domains!
Malware patterns with 1% to 20%
infection rate depending on network!
Browser hijacking + unknown malicious
activity!
Actively querying CNC multiple times/day!
Algorithm identifies infected PCs !
– CNC traffic can be blocked or monitored!

•These domains appear on threat lists
days after they are dormant!

acapulcosonars.com.
enticingsuperpower.com.
envelopspunnet.com.
evocationsmotliest.com.
heronsquadrupled.com.
infernalbrazing.com.
joininguncoils.com.
mumbleinterim.com.
pancakeskennels.com.
pesterlipid.com.

9!

Example: Ad Trackers!
Example Domains!
• Websites use many ad trackers• Seed with known ad trackers• Look for correlated query
patterns

2082.info.
6485.info.
7228.info.
daap.info.
drab.info.
ﬁiy.info.
ﬂob.info.

10!

Example: Botnet Clusters!
shjldview.info
zyuvl.info
rpcbfgrxcs.info
oxhgeuxxkit.info
oftguz.info
fatgdctn.info
zvnvlr.info
paougcwdvg.info
pxihq.info
fbbvzswf.info
nwvomw.info
clwkxxfoum.info
kthmu.info……

c5aeeb30263457a4fd91a6bb9abad118f5.cc
u51d1a1210429f081f18a8b7be709d874e.tk
l0631ad1b088946744d0ee6633ee49ab60.so
u469be0fce0d32e1afa59ad8f3541fed47.tk
o2035ca672ce4a36df1b8e1537e6089791.cc
gdd8b47256f3cff5133a72de1fde331109.tk
sf45d60e96ce5866098841b1b1f6fbaea8.tk…

columbinechristophers.net
columbinemiddlesworth.net
corianderchristophers.net
coriandermiddlesworth.net
corneliuschristophers.net
corneliusmiddlesworth.net
joscelinechristophers.net
joscelinemiddlesworth.net
katherynechristophers.net
katherynemiddlesworth.net
madelainechristophers.net
madelainemiddlesworth.net
maryvonnechristophers.net
maryvonnemiddlesworth.net
quintellachristophers.net……

11!

Example: DNS Tunneling!

cross-checked andconfirmed with thetunneling detection
algorithm

12!

Summary !
• DNS data reveals many interesting things!!
• DDoS!
• Bots/Malware!
• Adware!
• Tunnels!
• There will be many more insights !

13!

Thank You! !

14!