3 ms·

Nominum Domain Correlation

• bdamm 9y ago
  Fascinating. They don't mention but I can't help but wonder if time and source also are fed into the correlation net.
• lolc 9y ago
  Unfortunately the piece is light on the technical details.
  • minsight 9y ago
    If you're anywhere near France, and free in December, there's https://www.botconf.eu/2017/math-gpu-dns-cracking-locky-seeds-in-real-time-without-analyzing-samples/ https://www.botconf.eu/2017/math-gpu-dns-cracking-locky-seed...
• nine_k 9y ago
  Tl;dr: correlation of great many DNS queries allows to discover malware c&c networks, and block them. Works without prior knowledge, using just stats / ML.