Samuel Marchal, J. François, R. State
Dec 1, 2012
Citations
0
Influential Citations
6
Citations
Journal
2012 IEEE International Workshop on Information Forensics and Security (WIFS)
Abstract
In network level forensics, Domain Name Service (DNS) is a rich source of information. This paper describes a new approach to mine DNS data for forensic purposes. We propose a new technique that leverages semantic and natural language processing tools in order to analyze large volumes of DNS data. The main research novelty consists in detecting malicious and dangerous domain names by evaluating the semantic similarity with already known names. This process can provide valuable information for reconstructing network and user activities. We show the efficiency of the method on experimental real datasets gathered from a national passive DNS system.