Domain squatting is a common adversarial practice where attackers register domain names that are purposefully similar to popular domains. In this work, we study a specific type of domain squatting called "combosquatting," in which attackers register domains that combine a popular trademark with one or more phrases (e.g., betterfacebook[.]com, youtube-live[.]com). We perform the first large-scale, empirical study of combosquatting by analyzing more than 468 billion DNS records - collected from passive and active DNS data sources over almost six years. We find that almost 60% of abusive combosquatting domains live for more than 1,000 days, and even worse, we observe increased activity associated with combosquatting year over year. Moreover, we show that combosquatting is used to perform a spectrum of different types of abuse including phishing, social engineering, affiliate abuse, trademark abuse, and even advanced persistent threats. Our results suggest that combosquatting is a real problem that requires increased scrutiny by the security community.

As threat detection systems become critical for protecting modern organizations, visualization has emerged as an essential tool for security analysts to understand network threats. However, there is currently little research in designing and evaluating effective network threat analysis visualizations. To address this problem, we take a user-centered approach, starting with designing an open source threat analysis console for DNS-based network threat analysis grounded in both an understanding of analysts' needs and tasks and security visualization best practices. The proposed open source threat analysis console, called THACO (THreat Analysis COnsole), leverages open DNS datasets, domain WHOIS records, and both public malware and domain blacklists. It also uses a visually scalable visualization technique, a multi-grouping, zoomable treemap, to adapt to DNS-based network threat analysis needs. Then, we conduct a user study with 7 in-situ and 31 online IT security practitioners. Our code for THACO and THACO itself will be opened to the community in order to further improve the ability of analysts to perform network threat analysis and better secure their networks.

Electrical grid planning aims at optimizing the grid through the control of the performance and placement of electrical assets in order to minimize failures or vulnerabilities. With this purpose, grid planners carry out an initial stage of data exploration using a large volume of incident and equipment data collected over extensive time periods. In current practice these tasks are performed manually, which makes it very difficult to recognize patterns and gain insights into the data. In this paper, we propose a parallel multivariate visualization technique as a suitable approach for improving the existing practice. Based on the usage of an interactive visualization tool called BarExam, we demonstrate the feasibility of this visualization technique for displaying the dataset and present example insights that this visualization technique can provide to grid planners.