Semantic Exploration of DNS

Samuel Marchal (1, 2) , Jérôme François (1, 2) , Cynthia Wagner (1, 2) , Thomas Engel (1, 2)

1 SnT - Interdisciplinary Centre for Security Relaibility and Trust
2 Uni.lu - Université du Luxembourg

The DNS structure discloses useful information about the organization and the operation of an enterprise network, which can be used for designing attacks as well as monitoring domains supporting malicious activities. Thus, this paper introduces a new method for exploring the DNS domains. Although our previous work described a tool to generate existing DNS names accurately in order to probe a domain automatically, the approach is extended by leveraging semantic analysis of domain names. In particular, the semantic distributional similarity and relatedness of sub-domains are considered as well as sequential patterns. The evaluation shows that the discovery is highly improved while the overhead remains low, comparing with non semantic DNS probing tools including ours and others.

Domaines: Informatique [cs]; Réseaux et télécommunications [cs.NI]

Samuel Marchal, Jérôme François, Cynthia Wagner, Thomas Engel. Semantic Exploration of DNS. 11th International Networking Conference (NETWORKING), May 2012, Prague, Czech Republic. pp.370-384, ⟨10.1007/978-3-642-30045-5_28⟩. ⟨hal-00712849⟩