MD-Miner: Behavior-Based Tracking of Network Traffic for Malware-Control Domain Detection

Malicious domains are basic tools in the hands of cybercriminals. Once a victim is malware-infected, malware will tend to connect malicious domains to do internet crime such as awaiting the remote control command or delivering the malware reported feedback. Recent studies have paid much effort on detecting malicious domains, but still have room to improve. For the purpose of detecting malicious domains efficiently and accurately, we propose MD-Miner, a novel scalable system that tracks new malicious domains in large-volume of network traffic data. MD-Miner monitors the network traffic to build a process-domain bipartite graph representing who is connecting what. After labeling nodes in this process-domain graph that are known to be either benign or malicious-related, we propose a novel approach to accurately detect previously unknown malicious domains. In this paper, we implemented a proof-of-concept version of MD-Miner with assistance of MapReduce architecture. The experiment results show that MD-Miner can achieve AUC as good as 95% and find new malicious domain which cannot be identified by other reputation system. In addition, the scalability and applicability of MD-Miner is demonstrated by experiments on the real-world enterprise network traffic.