Abstract-In network level forensics, Domain Name Service (DNS) is a rich source of information. This paper describes a new approach to mine DNS data for forensic purposes. We propose a new technique that leverages semantic and natural language processing tools in order to analyze large volumes of DNS data. The main research novelty consists in detecting malicious and dangerous domain names by evaluating the semantic similarity with already known names. This process can provide valuable information for reconstructing network and user activities. We show the efficiency of the method on experimental real datasets gathered from a national passive DNS system.
Marchal et al. REF proposed a new technique that leveraged semantic and natural language processing tools to analyze large volumes of DNS data and identify malicious domain names.
Semantic based DNS forensics
2012 IEEE International Workshop on Information Forensics and Security (WIFS)
2012 IEEE International Workshop on Information Forensics and Security (WIFS)
Computer Science