(Georgia Institute of Technology, 2022-05)
Galloway, Tillson Thomas
The Domain Name System (DNS) has been an essential component of the Internet since 1985, mapping domain names that are easy to remember (e.g. google.com) to IPs that computers use to communicate (e.g. 30.3.5.2). DNS Reputation Systems use machine learning to identify malicious domains using large datasets containing DNS queries. We analyze the robustness of these reputation systems to attack and propose Mimicry Attacks, a novel technique that allows malicious domains to hide by mimicking the behavior of benign network infrastructure. This attack achieves an 85% success rate against active DNS datasets while coming at a low financial cost to the attacker.