Detecting Automatically Registered Domains
Bots are now being used to register domains giving attackers more options for pushing malware and launching phishing attacks. Fortunately, some basic text analysis techniques seem to the key to detecting when a machine registers a domain instead of a human.
Dark Reading is reporting on a tool from WebSense that seems to use n-grams or something similar:
The tool's algorithm determines whether a domain name was registered by man or machine, by assessing whether the domain and URL are "human consumable," or "whether someone would type that into a URL or search for that" site. It scores the likelihood of maliciousness of the domain and host name based on patterns in the name.
There aren't a lot of details on how this works for obvious reasons but a combination of n-gram and regular expression patterns culled from examples of machine registered domains would be my guess for the underlying algorithms.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
