Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Detecting Emerging Network Threats From Newly Observed Domains

Summary: Palo Alto Networks built a proactive detector that ingests newly observed domains (NODs) - domains seen carrying DNS traffic for the first time - and scans about 2.6 million of them daily, flagging roughly 2,300 as suspicious using machine learning models over WHOIS records, DNS traffic and hostname bigrams. In evaluation against VirusTotal, 37.11% of detected NODs were later confirmed malicious, and the detector flagged them an average of 4.79 days before any VirusTotal vendor, with 19.47% found more than a week earlier.

Why it matters: The detector's edge is time: it isolates malicious domains 4.79 days ahead of other vendors, and it caught 152 NODs that turned abusive more than a year after registration - domains a registration-time scanner would never see, including ones in TLDs like .ga, .ml and .tk whose domain lists and WHOIS data are not public.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related