Identifying APT Malware Domain Based on Mobile DNS Logging

TLDR

Advanced Persistent Threats pose a serious risk to sensitive information, yet current detection methods are time‑consuming and rely on in‑depth analysis of large data sets, while attackers exploit DNS to locate command‑and‑control servers and victim machines. This study proposes an efficient, high‑accuracy method for detecting APT malware command‑and‑control domains by analyzing mobile DNS logs. The approach extracts 15 features from mobile DNS logs, scores domains using Alexa ranking and VirusTotal judgments, selects normal domains, and applies a Global Abnormal Forest anomaly‑detection algorithm, demonstrating superior computational efficiency and recognition accuracy compared to existing methods. The method achieves over 99 % F‑measure and recall against LOF, KNN, and Isolation Forest, while reducing the volume of data required for analysis and enabling unsupervised learning.

Abstract

Advanced Persistent Threat (APT) is a serious threat against sensitive information. Current detection approaches are time‐consuming since they detect APT attack by in‐depth analysis of massive amounts of data after data breaches. Specifically, APT attackers make use of DNS to locate their command and control (C&C) servers and victims’ machines. In this paper, we propose an efficient approach to detect APT malware C&C domain with high accuracy by analyzing DNS logs. We first extract 15 features from DNS logs of mobile devices. According to Alexa ranking and the VirusTotal’s judgement result, we give each domain a score. Then, we select the most normal domains by the score metric. Finally, we utilize our anomaly detection algorithm, called Global Abnormal Forest (GAF), to identify malware C&C domains. We conduct a performance analysis to demonstrate that our approach is more efficient than other existing works in terms of calculation efficiency and recognition accuracy. Compared with Local Outlier Factor (LOF), k ‐Nearest Neighbor (KNN), and Isolation Forest (iForest), our approach obtains more than 99% F ‐ M and R for the detection of C&C domains. Our approach not only can reduce data volume that needs to be recorded and analyzed but also can be applicable to unsupervised learning.