Hacker News Reader

The project discussed in this paper requires having access to all of the passive DNS data in an entire ISP's network, which isn't that practical for many researchers.

OP's machine learning is arguably even more impressive, because it has a decent success rate based entirely on open source data and the domain names themselves, with no other corroborating information (like a NXDOMAIN response).

View on HN

You only need large quantities of pDNS data for the discovery portion. For classification all you need are collections of domains produced by the same algorithm ( which are readily available for the widely-known DGAs.) The domains being NX isn't so much corroboration as fundament -- the NX-producing search over multiple domains is the observable behavioral distinction between AGD vs static C&C discovery.

(I've worked with both Antonakakis and Yadav, and implemented the production version of Damballa's AGD classifier as per Antonakakis).

Reply on news.ycombinator.com