Detecting and remediating highly vulnerable domain names using passive DNS measurements

A system for detecting highly-vulnerable domain names and remediating associated problems, the system comprising:

• a network interface configured to collect, electronically, domain name system (DNS) data representing a plurality of requests to the DNS by a plurality of entities over a period of time;
• and
• at least one electronic processor configured to:
• determine a subset of the DNS data representing a plurality of DNS-based service discovery requests to unregistered domains over the period of time, wherein at least one of the unregistered domains corresponds to a domain of an internal namespace;
• for each of the unregistered domains, determine a query ratio comprising a ratio of DNS service discovery requests for the unregistered domain to total DNS requests for the unregistered domain over the period of time;
• for each of the unregistered domains, determine a persistence ratio comprising a ratio of distinct time segments during which DNS-based service discovery requests were made for the unregistered domain to total distinct time segments in the period of time;
• rank the unregistered domains according to a metric comprising the query ratios and the persistence ratios, whereby a ranked list of domain names is produced;
• output an initial segment of the ranked list of domain names as the highly-vulnerable domain names;
• and
• remediate attacks on at least one of the highly-vulnerable domain names.

At least one non-transitory computer readable medium comprising instructions which, when executed by at least one electronic processor, cause the processor to perform a method of detecting highly-vulnerable domain names and remediating associated problems by:

• collecting, electronically, domain name system (DNS) data representing a plurality of requests to the DNS by a plurality of entities over a period of time;
• determining a subset of the DNS data representing a plurality of DNS-based service discovery requests to unregistered domains over the period of time, wherein at least one of the unregistered domains corresponds to a domain of an internal namespace;
• for each of the unregistered domains, determining a query ratio comprising a ratio of DNS service discovery requests for the unregistered domain to total DNS requests for the unregistered domain over the period of time;
• for each of the unregistered domains, determining a persistence ratio comprising a ratio of distinct time segments during which DNS-based service discovery requests were made for the unregistered domain to total distinct time segments in the period of time;
• ranking the unregistered domains according to a metric comprising the query ratios and the persistence ratios, whereby a ranked list of domain names is produced;
• outputting an initial segment of the ranked list of domain names as the highly-vulnerable domain names;
• and
• remediating attacks on at least one of the highly-vulnerable domain names.