Moving forward and focusing our attention on another great
analysis technique based on frequency of occurrence.
First off,
frequency represents the number of occurrences of a
repeating event per unit of time.
Essentially,
what we'll be doing is to aggregate and count the number
of occurrences based on their type.
Specific to DNS traffic, we'll group requests based on the domain.
This technique can be applied at the host and even
much wider at the network level.
Calculating occurrence is a concept that is better explained
by example rather than in technical terms.
Let's consider that we gather a list of domain names
over the course of a specific period.
We then perform a count operation for each unique domain name and see
how many DNS requests were made for that domain.
The trend that we expect to see is the following.
We have domains with a high occurrence, CDN traffic,
cloud providers, and ad networks are the ones that fall under this category.
At the other end of the spectrum,
there are domains and websites visited very rarely,
maybe by one or two users.
And this is our area of interest.
We want to scan through this and see if we can identify any rogue domains.
Once we have a list of potentially suspicious domains,
we can chain this together with another technique,
which is identifying similar domains.
Typosquatting refers to end users mistyping a domain and
navigating to somewhere else than they're supposed to.
For example,
a well known technique is to replace characters with similar looking
characters like replacing an L for Lima with a 1.
Well,
attackers became aware of this and started to register these
domains with the goal of tricking people into visiting cloned
websites and stealing their credentials.
There is a nice algorithm available in Python.
It's part of the difflib module.
With SequenceMatcher it's possible to compare two
strings and extract a similarity ratio.
We can use this to implement it in our script.