Utilizing DNS and VirusTotal for Automated Ad-Malware Detection

In this paper, we present a novel approach to the automated detection of ad-malware. We efficiently crawl a vast set of websites and extensively fetch all HTTP requests embedded in these websites.Then we query these requests both against filtered DNS resolvers and VirusTotal. The idea is to evaluate, how much content is labeled as a potential threat. The results show that up to 8.8% of the domains found in our approach are labeled as suspicious. Moreover, up to 3.2% of these domains are categorized as ad-malware. However, the overall responses from the used services paint a divergent picture: Both DNS resolvers and VirusTotal have different understandings to the definition of suspicious content.