Cardinality Analysis to Classify Malicious Domain Names

Abuse of the Internet (e.g., spam mailing, phishing, and other antisocial behaviors) is increasing. Blocking such abuses with blacklists is used as a typical countermeasure. A blacklist contains malicious hosts on the Internet reputed to send spam mail, employ phishing, and engage in other antisocial behaviors. By retrieving the blacklists each time when users receive emails, users can reject spam mails. However, it is difficult to keep up with the new malicious hosts created every day, so research is required to maintain the blacklist. In this study, we propose a classification method whose recall rate (97.3%) is higher than that of the best single public blacklist (48.9%). Cardinality analysis, which identifies the access pattern of multiple clients to various domain names, is the main technique of the proposed method. We explain the method together with the results of experiments use 26M domain name system query–response data.