Analysis of the Similarities in Malicious DNS Domain Names

This paper presents results of studies on similarities in the construction of malicious DNS domain names. Based on sets of malicious domain names (or URLs, where only mnemonic host names are taken into account) a prototype tool searches for formulated similarities in the construction of malicious domains. A key research task was to find features of similarity which could be useful in the detection of malicious behavior. Research results can be used as an additional characteristic of existing heuristic methods for determining the malicious character of domains or websites. They could also be used as a hint for specialists to take a closer look at domains which are similar to other malicious domains.