NDEWS: A new domains early warning system for TLDs

Giovane C.M. Moura; Moritz Müller; Maarten Wullink; Cristian Hesselman

doi:10.1109/NOMS.2016.7502961

NDEWS: A new domains early warning system for TLDs

Giovane C.M. Moura
, Moritz Müller
, Maarten Wullink
, Cristian Hesselman

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

17 Citations (Scopus)

Abstract

We present nDEWS, a Hadoop-based automatic early warning system of malicious domains for domain name registry operators, such as top-level domain (TLD) registries. By monitoring an entire DNS zone, nDEWS is able to single out newly added suspicious domains by analyzing both domain registration and global DNS lookup patterns of a TLD. nDEWS is capable to detect several types of domain abuse, such as malware, phishing, and allegedly fraudulent web shops. To act on this data, we have established a pilot study with two major.nl registrars, and provide them with daily feeds of their respective suspicious domains. Moreover, nDEWS can also be implemented by other TLD operators/registries.

Original language	English
Title of host publication	Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium
Editors	Sema Oktug Badonnel, Mehmet Ulema, Cicek Cavdar, Lisandro Zambenedetti Granville, Carlos Raniery P. dos Santos
Publisher	IEEE
Pages	1061-1066
Number of pages	6
ISBN (Electronic)	9781509002238
DOIs	https://doi.org/10.1109/NOMS.2016.7502961
Publication status	Published - 30 Jun 2016
Externally published	Yes
Event	2016 IEEE/IFIP Network Operations and Management Symposium, NOMS 2016: Managing Everything toward a Secure, Smart, and Hyperconnected World - Suleyman Demirel Cultural Center, Istanbul, Turkey Duration: 25 Apr 2016 → 29 Apr 2016 Conference number: 15 https://noms2016.ieee-noms.org/ http://noms2016.ieee-noms.org/

Publication series

Name	Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium

Conference

Conference	2016 IEEE/IFIP Network Operations and Management Symposium, NOMS 2016
Abbreviated title	NOMS 2016
Country/Territory	Turkey
City	Istanbul
Period	25/04/16 → 29/04/16
Internet address	https://noms2016.ieee-noms.org/ http://noms2016.ieee-noms.org/

Keywords

n/a OA procedure

Access to Document

10.1109/NOMS.2016.7502961

Cite this

Moura, G. C. M., Müller, M., Wullink, M., & Hesselman, C. (2016). NDEWS: A new domains early warning system for TLDs. In S. O. Badonnel, M. Ulema, C. Cavdar, L. Z. Granville, & C. R. P. dos Santos (Eds.), Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium (pp. 1061-1066). Article 7502961 (Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium). IEEE. https://doi.org/10.1109/NOMS.2016.7502961

Moura, Giovane C.M. ; Müller, Moritz ; Wullink, Maarten et al. / NDEWS : A new domains early warning system for TLDs. Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium. editor / Sema Oktug Badonnel ; Mehmet Ulema ; Cicek Cavdar ; Lisandro Zambenedetti Granville ; Carlos Raniery P. dos Santos. IEEE, 2016. pp. 1061-1066 (Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium).

@inproceedings{5ae5d20ffadd4b11b388c02f1bdcabcd,

title = "NDEWS: A new domains early warning system for TLDs",

abstract = "We present nDEWS, a Hadoop-based automatic early warning system of malicious domains for domain name registry operators, such as top-level domain (TLD) registries. By monitoring an entire DNS zone, nDEWS is able to single out newly added suspicious domains by analyzing both domain registration and global DNS lookup patterns of a TLD. nDEWS is capable to detect several types of domain abuse, such as malware, phishing, and allegedly fraudulent web shops. To act on this data, we have established a pilot study with two major.nl registrars, and provide them with daily feeds of their respective suspicious domains. Moreover, nDEWS can also be implemented by other TLD operators/registries.",

keywords = "n/a OA procedure",

author = "Moura, \{Giovane C.M.\} and Moritz M{\"u}ller and Maarten Wullink and Cristian Hesselman",

note = "Publisher Copyright: {\textcopyright} 2016 IEEE.; 2016 IEEE/IFIP Network Operations and Management Symposium, NOMS 2016 : Managing Everything toward a Secure, Smart, and Hyperconnected World, NOMS 2016 ; Conference date: 25-04-2016 Through 29-04-2016",

year = "2016",

month = jun,

day = "30",

doi = "10.1109/NOMS.2016.7502961",

language = "English",

series = "Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium",

publisher = "IEEE",

pages = "1061--1066",

editor = "Badonnel, \{Sema Oktug\} and Mehmet Ulema and Cicek Cavdar and Granville, \{Lisandro Zambenedetti\} and \{dos Santos\}, \{Carlos Raniery P.\}",

booktitle = "Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium",

address = "United States",

url = "https://noms2016.ieee-noms.org/, http://noms2016.ieee-noms.org/",

}

Moura, GCM, Müller, M, Wullink, M & Hesselman, C 2016, NDEWS: A new domains early warning system for TLDs. in SO Badonnel, M Ulema, C Cavdar, LZ Granville & CRP dos Santos (eds), Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium., 7502961, Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium, IEEE, pp. 1061-1066, 2016 IEEE/IFIP Network Operations and Management Symposium, NOMS 2016, Istanbul, Turkey, 25/04/16. https://doi.org/10.1109/NOMS.2016.7502961

NDEWS: A new domains early warning system for TLDs. / Moura, Giovane C.M.; Müller, Moritz; Wullink, Maarten et al.
Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium. ed. / Sema Oktug Badonnel; Mehmet Ulema; Cicek Cavdar; Lisandro Zambenedetti Granville; Carlos Raniery P. dos Santos. IEEE, 2016. p. 1061-1066 7502961 (Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - NDEWS

T2 - 2016 IEEE/IFIP Network Operations and Management Symposium, NOMS 2016

AU - Moura, Giovane C.M.

AU - Müller, Moritz

AU - Wullink, Maarten

AU - Hesselman, Cristian

N1 - Conference code: 15

PY - 2016/6/30

Y1 - 2016/6/30

N2 - We present nDEWS, a Hadoop-based automatic early warning system of malicious domains for domain name registry operators, such as top-level domain (TLD) registries. By monitoring an entire DNS zone, nDEWS is able to single out newly added suspicious domains by analyzing both domain registration and global DNS lookup patterns of a TLD. nDEWS is capable to detect several types of domain abuse, such as malware, phishing, and allegedly fraudulent web shops. To act on this data, we have established a pilot study with two major.nl registrars, and provide them with daily feeds of their respective suspicious domains. Moreover, nDEWS can also be implemented by other TLD operators/registries.

AB - We present nDEWS, a Hadoop-based automatic early warning system of malicious domains for domain name registry operators, such as top-level domain (TLD) registries. By monitoring an entire DNS zone, nDEWS is able to single out newly added suspicious domains by analyzing both domain registration and global DNS lookup patterns of a TLD. nDEWS is capable to detect several types of domain abuse, such as malware, phishing, and allegedly fraudulent web shops. To act on this data, we have established a pilot study with two major.nl registrars, and provide them with daily feeds of their respective suspicious domains. Moreover, nDEWS can also be implemented by other TLD operators/registries.

KW - n/a OA procedure

UR - https://www.scopus.com/pages/publications/84979766898

U2 - 10.1109/NOMS.2016.7502961

DO - 10.1109/NOMS.2016.7502961

M3 - Conference contribution

AN - SCOPUS:84979766898

T3 - Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium

SP - 1061

EP - 1066

BT - Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium

A2 - Badonnel, Sema Oktug

A2 - Ulema, Mehmet

A2 - Cavdar, Cicek

A2 - Granville, Lisandro Zambenedetti

A2 - dos Santos, Carlos Raniery P.

PB - IEEE

Y2 - 25 April 2016 through 29 April 2016

ER -

Moura GCM, Müller M, Wullink M, Hesselman C. NDEWS: A new domains early warning system for TLDs. In Badonnel SO, Ulema M, Cavdar C, Granville LZ, dos Santos CRP, editors, Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium. IEEE. 2016. p. 1061-1066. 7502961. (Proceedings of the NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium). doi: 10.1109/NOMS.2016.7502961

NDEWS: A new domains early warning system for TLDs

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this