Static DNSBL (blacklist) model: new IP addresses are trusted until proven guilty - increasingly ineffective. Need a dynamic, comprehensive reputation system that outputs scores for domains.
Short-lived domains - fast-flux, quick turnover
Anonymously registered domains
Disposable domains
Detection heuristics: number of characters, hyphens, digits in domain names.
DNS Blacklist (DNSBL) levels categorize trust in IP addresses for spam/email.
| Level | Description |
|---|---|
| White | Complete trust |
| Black | No trust |
| Grey | Known to produce both spam and non-spam |
| Yellow | Associated with spam-like behaviors but not directly spamming |
| NoBL | Does not send spam, not fully trustworthy |
NOTOS dynamically assigns reputation scores to domain names using passive DNS. Monitors at recursive DNS level.
From RHIPs: total IPs, geo diversity, distinct ASs, etc.
From RHDNs: avg domain length, TLDs, character frequency
Malware samples that contacted domain or resolved IPs
Kopis uses passive monitoring at the upper DNS hierarchy - AuthDNS and TLD servers. Internet-wide visibility.
NOTOS: recursive DNS (RDNS). Kopis: Authoritative (TLDs, AuthNS, Root). Different vantage points.
Are querying machines (RDNS) localized or globally distributed? BGP prefixes, AS, country codes.
ISP/small business vs home. Higher weight for RDNS serving large client populations.
Historical linkage of resolved IPs to malicious or legitimate activities.
High TP (98.4%), low FP (0.3%). Identifies new malicious domains weeks before blacklists. Detected China DDoS botnet ~1 month before propagation elsewhere.
How prevalent are mobile infections? Mobile malware uses similar C&C infrastructure as desktop. Approach: DNS traffic in cellular network → domains looked up by mobile apps → analyze hosts.
Three months from major US cellular + non-cellular ISP. Known mobile malware samples rare: 6,585 of 380M devices (0.002%). iOS vs Android equally likely to connect to suspicious domains.