There exists a significant number of domains that have frequently switched their name servers for several reasons. In this work, we delved into the analysis of name-server switching behavior and presented a novel identifier called "NS-Switching Footprint" (NSSF) that can be used to cluster domains, enabling us to detect domains with suspicious behavior. We also designed a model that represents a time series, which could be used to predict the number of name servers that a domain will interact with. We performed the experiments with the dataset that captured all. com and. net zone changing transactions (i.e., adding or deleting name servers for domains) from March 28 to June 27, 2013.
In this work, we look at name server switching of domains, with the potential abuse and security as the motivation to understanding name server dynamics. We use the evolution of name servers to build an identifier for domains that can be used to group domains of similar behavior. We have also presented a time series based number of name servers prediction model for domains.
R. Scott Cost合作论文数University of Maryland Baltimore County10
Ryusuke Masuoka合作论文数10
Bijan Parsia合作论文数Department of Computer Science, School of Engineering, The University of Manchester3
William J. Tolone合作论文数Software and Information Systems; University of North Carolina at Charlotte2