Hypergraph Analytics of Domain Name System Relationships

Conference · Tue Jun 02 04:00:00 EDT 2020

DOI:https://doi.org/10.1007/978-3-030-48478-1_1· OSTI ID:1646230

Joslyn, Cliff A. ^[1]; Aksoy, Sinan G. ^[1]; Arendt, Dustin L. ^[1]; Firoz, Jesun S. ^[1]; Jenkins, Louis ^[2]; Praggastis, Brenda L. ^[1]; Purvine, Emilie AH ^[1]; Zalewski, Marcin J. ^[1]

---

1. BATTELLE (PACIFIC NW LAB)
2. UNIVERSITY OF ROCHESTER

We report on the use of novel mathematical methods in hypergraph analytice over a large quantity of DNS data. Hypergraphs generalize graphs, as used in network science, to better model complex multiway relations in cyber data. Specifically, casting DNS data from Georgia Tech's ActiveDNS repository as hypergraphs allows us to fully represent the interactions between {\em collections} of domains and IP addresses. To facilitate large-scale analytics, we fielded an analytical pipeline of two capabilities. HyperNetX (HNX) is a Python package for the exploration and visualization of hypergraphs, acting as a frontend. For the backend, the Chapel HyperGraph Library (CHGL) is a library for high performance hypergraph analytics written in the exascale programming language Chapel. CHGL was used to process gigascale DNS data, performing compute-intensive calculations for data reduction and segmentation. Identified portions are then sent to HNX for both exploratory analysis and knowledge discovery targeting known tactics, techniques, and procedures.

• Research Organization: Pacific Northwest National Laboratory (PNNL), Richland, WA (United States)
• Sponsoring Organization: USDOE
• DOE Contract Number: AC05-76RL01830
• OSTI ID: 1646230
• Report Number(s): PNNL-SA-151833
• Country of Publication: Switzerland
• Language: English