This paper proposes a method to detect two primary means of using the Domain Name
System (DNS) for malicious purposes. We develop machine learning models to detect …

DNS DDoS attacks may severely affect the operation of computer networks, prompting the
need for methods able to timely detect them, and then to apply mitigation countermeasures …

Most modern cyber crime leverages the Domain Name System (DNS) to attain high levels of
network agility and make detection of Internet abuse challenging. The majority of malware …

Enterprise networks are under enormous threats from sophisticated cyber-attacks. Various
kinds of malware are installed by attackers on compromised hosts, acting as bots that …

Worms are arguably the most serious security threat facing the Internet. Motivated to develop
a detection technique that is both efficient and accurate enough to enable automatic …

DNS is often used by attackers as a covert channel for data exfiltration, also known as DNS
tunneling. Since the plaintext DNS lookup leads to privacy issues, DNS over HTTPS (DoH) …

DNS tunneling is a typical DNS attack that has been used for stealing information for many
years. The stolen data is encoded and encapsulated into the DNS request to evade intrusion …

In this article, we propose Segugio, a novel defense system that allows for efficiently tracking
the occurrence of new malware-control domain names in very large ISP networks. Segugio …

Attackers often use URLs to advertise scams or propagate malware. Because the reputation
of a domain can be used to identify malicious behavior, miscreants often register these …

The edns-client-subnet (ECS) is a new extension for the Domain Name System (DNS) that
delivers a “faster Internet” with the help of client-specific DNS answers. Under ECS …