A Practical Machine Learning-Based Framework to Detect DNS Covert Communication in Enterprises

[1]  Vijay Sivaraman,et al.  Monitoring Enterprise DNS Queries for Detecting Data Exfiltration From Internal Hosts , 2020, IEEE Transactions on Network and Service Management.

[2]  Jiahai Yang,et al.  HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification , 2019, RAID.

[3]  Hui Zhang,et al.  D3N: DGA Detection with Deep-Learning Through NXDomain , 2019, KSEM.

[4]  Vijay Sivaraman,et al.  Real-Time Detection of DNS Exfiltration and Tunneling from Enterprise Networks , 2019, 2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM).

[5]  Suphannee Sivakorn,et al.  Countering Malicious Processes with Process-DNS Association , 2019, NDSS.

[6]  Ding Li,et al.  NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage , 2019, NDSS.

[7]  Ying Liu,et al.  Who is answering my queries: understanding and characterizing interception of the DNS resolution path , 2019, USENIX Security Symposium.

[8]  Ahmad Jakalan,et al.  Identifying Fast-Flux Botnet With AGD Names at the Upper DNS Hierarchy , 2018, IEEE Access.

[9]  Ulrike Meyer,et al.  FANCI : Feature-based Automated NXDomain Classification and Intelligence , 2018, USENIX Security Symposium.

[10]  Madhusudana V. S. Shashanka,et al.  Detection of Exfiltration and Tunneling over DNS , 2017, 2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA).

[11]  Zhou Li,et al.  Don't Let One Rotten Apple Spoil the Whole Barrel: Towards Automated Detection of Shadowed Domains , 2017, CCS.

[12]  Bruce M. Maggs,et al.  A Longitudinal, End-to-End View of the DNSSEC Ecosystem , 2017, USENIX Security Symposium.

[13]  Nick Feamster,et al.  Global Measurement of DNS Manipulation , 2017, USENIX Security Symposium.

[14]  Johannes Bader,et al.  A Comprehensive Measurement Study of Domain Generating Malware , 2016, USENIX Security Symposium.

[15]  Mohammad Mehdi Ahmadian,et al.  Connection-monitor & connection-breaker: A novel approach for prevention and detection of high survivable ransomwares , 2015, 2015 12th International Iranian Society of Cryptology Conference on Information Security and Cryptology (ISCISC).

[16]  Zhou Li,et al.  Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data , 2014, 2015 45th Annual IEEE/IFIP International Conference on Dependable Systems and Networks.

[17]  Anthony Keane,et al.  Detection of DNS Based Covert Channels , 2015 .

[18]  Aiko Pras,et al.  DNSSEC and its potential for DDoS attacks: a comprehensive measurement study , 2014, Internet Measurement Conference.

[19]  Chris Kanich,et al.  The Long "Taile" of Typosquatting Domain Names , 2014, USENIX Security Symposium.

[20]  Stefano Zanero,et al.  Phoenix: DGA-Based Botnet Tracking and Intelligence , 2014, DIMVA.

[21]  Hovav Shacham,et al.  Measuring the Practical Impact of DNSSEC Deployment , 2013, USENIX Security Symposium.

[22]  Vern Paxson,et al.  Practical Comprehensive Bounds on Surreptitious Communication over DNS , 2013, USENIX Security Symposium.

[23]  Vinod Yegneswaran,et al.  An empirical reexamination of global DNS behavior , 2013, SIGCOMM.

[24]  Roberto Perdisci,et al.  From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware , 2012, USENIX Security Symposium.

[25]  Donald E. Eastlake,et al.  Domain Name System Security Extensions , 1997, RFC.

[26]  Jianhua Lin,et al.  Divergence measures based on the Shannon entropy , 1991, IEEE Trans. Inf. Theory.

[27]  Paul V. Mockapetris,et al.  Domain names - implementation and specification , 1987, RFC.