COBRA: A Content-Agnostic Framework for Zero-Day Detection of Suspicious Domains
COBRA clusters newly registered domain names to flag suspicious domains at registration time, finding 47K domains with 98.5% precision before threat intel does.
Researchers propose COBRA, a content-agnostic framework that detects suspicious domains at registration time by clustering names of newly registered domains by lexical and structural similarity, without needing any hosted content. Evaluated on 1.5M newly created domains, it achieved 98.5% precision and identified over 47K distinct suspicious domains. It identified 80% of suspicious or malicious domains earlier than a widely used threat-intelligence service, which in some cases needs up to 7 days.
- Classifies domains before content deployment using only name-based clustering
- 98.5% precision across 1.5M newly registered domains; 47K+ suspicious domains identified
- Flags 80% of malicious domains earlier than a leading threat-intelligence service
- Organizations
- COBRA
From the original article
1 min read at arxiv.orgThe use of malicious domains is central to cyberattacks such as phishing, malware distribution, impersonation, and fraudulent transactions. Because domains are inexpensive to register and easy to deploy at scale, they remain one of the most common and damaging tools used in cybercrime across industries. Proactive detection is essential to reducing this window of vulnerability and preventing harm to users.
By Alexandros Fourtounis · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.