Subject: [Nmlrg] NMLRG session @ IETF / ref about malicious domains detection with time series

From: <[email-masked]>
Date: Thu, 7 Apr 2016 15:46:48 +0000

Hi Giovane, All,

We worked in 2014-2015 on malicious domains detection with DNS traffic analysis via time series models (for # of NXDOMAINs DNS answers) within a supervised learning framework (with decision trees models). I am not enclosing our paper and presentation slides (at RAID 2015 conference) related to these works for unspamming purposes on the NMLRG reflector, but for those interested, just drop me a line and I'll send the documents to you.

Cheers,
Stephane

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: "Giovane C. M. Moura" <[email-masked]>
Date: Thu, 7 Apr 2016 15:20:12 -0300

Dear Stephane, all,

Thanks for reaching out and sharing your paper, I'll read it carefully
once I am back in the Netherlands.

Just a couple of quick remarks (please correct if I'm wrong):

 1. DNS server: the term DNS server sometimes is used to refer to DNS
Resolvers and DNS Authoritative servers. The former are for example,
servers such as 8.8.8.8 or you local ISP that recursively tries to
resolver a name on your behalf.

Consider the figure (simplified) below: an user's computer wants to
resolve example.nl, it then contacts the resolvers on its ISP, which, on
his/her behalf, contacts the .nl authoritative server. The authoritative
servers, in turns ,is the one who has the records for example.nl ,and
returns as response (Say an A record 192.168.1.1)

 --------         -------------------        ------------------
| user   |  <--> | DNS resolver (ISP)| <--> | .nl authoritative|
  -------         -------------------        ------------------
Q: example.nl     Q: example.nl               Res: 192.168.1.1

Your paper has used data from resolvers, right?

We, on the other hand, run authoritative DNS servers for the .nl
top-level domain (TLD), so we do not resolve names on behalf of the
users, but respond to queries to .nl DNS requests we receive from
resolvers. That is the type of dataset I use on nDEWS.

This difference is important because the type of traffic each one sees
is different: you see every single user's queries, we see a fraction of
these which are sent by the resolver. This is because resolvers
implement caches to improve performance, so if a 2nd user ask for
example.nl after the first one, the resolver will respond without asking
the authoritative server, given the value in the cache is not yet expired).

I am just saying this is a remark since I'll have to consider that when
doing time-series based analysis, since we do not have all data points.

 2. Botnet DGA detection on the auth server: we actually have a project
on that (by Marco Davids, who helped me with the answer on QNAME
minimization): we detect DGAs on authoritative servers by analyzing
query patterns on NXDOMAINS in our zone -- i.e., domains that do not
exist under .nl. We have a paper on APWG ecrime2016 coming up on that
(industry track) that I am happy to share in case you're interested.

Thanks,

/giovane

On 04/07/2016 12:46 PM, [email-masked] wrote:
> Hi Giovane, All,
> 
>  
> 
> We worked in 2014-2015 on malicious domains detection with DNS traffic
> analysis via time series models (for # of NXDOMAINs DNS answers) within
> a supervised learning framework (with decision trees models). I am not
> enclosing our paper and presentation slides (at RAID 2015 conference)
> related to these works for unspamming purposes on the NMLRG reflector,
> but for those interested, just drop me a line and I’ll send the
> documents to you.
> 
>  
> 
> Cheers,
> 
> Stephane  

-- 
Giovane C. M. Moura, Ph.D.
Data Scientist
SIDN | Meander 501 | 6825 MD | Postbus 5022 | 6802 EA | ARNHEM, NL
[email-masked] | http://www.sidn.nl/

---

From: Jérôme François <[email-masked]>
Date: Mon, 18 Apr 2016 10:13:16 +0200

Hi,

Looking at the programme of EuCNC, workshops are planned on Monday 27th.
Is NMLRG#3 confirmed on Monday as well?

Thanks,
jerome

---

From: Sheng Jiang <[email-masked]>
Date: Mon, 18 Apr 2016 09:56:00 +0000

Hi, Jerome & all,

Yes, we have gotten positive response from the EuCNC committee. For now, we are on the after Monday, June 27th, with a 90 min session. However, there may be flexibility for more discussions besides this official session. It would depends on the RG participants. We would send out call for agenda later next week.

Best regards,

Sheng

>-----Original Message-----
>From: nmlrg [mailto:[email-masked]] On Behalf Of Jér?me Fran?ois
>Sent: Monday, April 18, 2016 4:13 PM
>To: [email-masked]
>Subject: [Nmlrg] NMLRG at EuCNC
>
>Hi,
>
>_______________________________________________
>nmlrg mailing list
>[email-masked]
>https://www.irtf.org/mailman/listinfo/nmlrg