Semantic based DNS forensics

2012 IEEE International Workshop on Information Forensics and Security (WIFS) Pub Date : 2012-12-01 DOI:10.1109/WIFS.2012.6412631

Samuel Marchal, J. François, R. State, T. Engel

引用次数: 6

Abstract

In network level forensics, Domain Name Service (DNS) is a rich source of information. This paper describes a new approach to mine DNS data for forensic purposes. We propose a new technique that leverages semantic and natural language processing tools in order to analyze large volumes of DNS data. The main research novelty consists in detecting malicious and dangerous domain names by evaluating the semantic similarity with already known names. This process can provide valuable information for reconstructing network and user activities. We show the efficiency of the method on experimental real datasets gathered from a national passive DNS system.

查看原文

微信好友朋友圈 QQ好友复制链接

本刊更多论文

基于语义的DNS取证

在网络级取证中，域名服务(DNS)是一个丰富的信息源。本文描述了一种用于取证目的的DNS数据挖掘的新方法。我们提出了一种利用语义和自然语言处理工具来分析大量DNS数据的新技术。主要的研究新颖之处在于通过评估与已知域名的语义相似度来检测恶意和危险域名。这个过程可以为重建网络和用户活动提供有价值的信息。我们在一个国家无源DNS系统的实验数据集上证明了该方法的有效性。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文去求助

来源期刊

2012 IEEE International Workshop on Information Forensics and Security (WIFS)

自引率

0.00%

发文量

期刊最新文献

Designing steganographic distortion using directional filters AC-3 bit stream watermarking Privacy-preserving architecture for forensic image recognition Active content fingerprinting: A marriage of digital watermarking and content fingerprinting Optimum forensic and counter-forensic strategies for source identification with training data