Volumetric clustering on large-scale dns data

Abstract

In an approach, a processor receives a set of normal domains, a set of suspicious domains, and a set of malicious domains; labels each domain of the set of normal domains as normal producing a labelled set of normal domains and each domain of the set of suspicious domains and the set of malicious domains as malicious producing a labelled set of malicious domains; samples a preset percentage of the labelled set of normal domains producing a sampled set of normal domains; aggregates the sampled set of normal domains and the labelled set of malicious domains producing a set of aggregated domains; filters the set of aggregated domains using hit size, inter-arrival-time, and univariate volumetric filters producing a set of filtered domains; and determines a cluster of a set of clusters to which each of the set of filtered domains is to be assigned using a trained K-shape model.