Classification of Compromised versus Maliciously Registered Domains

Classification of COmpromised versus Maliciously Registered domains (COMAR) is a joint research project with the goal of using machine learning to classify types of domain exploitation. It is led by SIDN Labs, AFNIC Labs, and Grenoble Alps University (GAU). The Franco-Dutch project distinguishes automatically between domain names registered by cybercriminals for the purpose of malicious activities and domain names exploited through vulnerable web applications. The project is designed to help intermediaries, such as registrars and ccTLD registries, optimize their anti-abuse processes. A domain name classified as maliciously registered should be blocked by the registry or registrar, by removing the name from the zone file. A legitimate but compromised domain name should not be blocked. Instead, just the malicious content should be removed by the hosting provider or domain owner (registrant).

Research Committee

• Cristian Hesselman (Manager SIDN Labs)
• Benoit Ampeau (Director Partnerships & Innovations, AFNIC Labs)
• Maciej Korczyński (Faculty member at GAU & PI of the COMAR project)
• Sourena Maroofi (Ph.D. student at GAU)