<p>A flow diagram of the end-to-end fingerprint processing pipeline.</p> Full article ">Figure 2
<p>The raw fingerprint produced from the active scan.</p> Full article ">Figure 3
<p>A screenshot of the HEAD request being made, as seen within Wireshark. The HTTP Protocol is highlighted in green.</p> Full article ">Figure 4
<p>A screenshot of a typical set of HTTP headers received in response to a HEAD request during the header enrichment process. The HEAD request is seen in red, the HTTP response is blue.</p> Full article ">Figure 5
<p>Graph displaying TLS features enriched with HTTP header data. The resulting feature matrix <math display="inline"><semantics> <mrow> <mi>M</mi> <mo>∈</mo> <msup> <mrow> <mo>{</mo> <mn>0</mn> <mo>,</mo> <mn>1</mn> <mo>}</mo> </mrow> <mrow> <mi>n</mi> <mo>×</mo> <mi>d</mi> </mrow> </msup> </mrow> </semantics></math> has dimensions <span class="html-italic">n</span> = 16,254 (fingerprints) and <span class="html-italic">d</span> = 2124 (features), representing the complete binary feature space of the TLS and HTTP characteristics. Known good domains are coloured green, known bad domains, red and unknown domains, orange.</p> Full article ">Figure 6
<p>The Mixed Host dataset displays a diverse number of distance metrics and a broader distribution of similarity scores across the sample space. Each line represents a different domain, with a range of colors to aid in differentiation.</p> Full article ">Figure 7
<p>The Cloudflare CDN dataset displays less diversity in similarity. All k-nearest neighbours maintain distances below 0.30. This shows closer similarity between domains. Each line represents a different domain, with a range of colors to aid in differentiation.</p> Full article ">Figure 8
<p>A typical domain with strong indicators of malicious intent. The domain was sourced from the unknown category and registered within 30 days of the scan taking place. At the time of evaluation, 12 security vendors had flagged the domain as malicious, including Sophos, Fortinet, ESET and Bitdefender.</p> Full article ">Figure 9
<p>An example of a domain on the threshold for further investigation. The domain has three vendors confirmed as malicious—BitDefender, CRDF and G-Data—but a further suspicious flag from vendor Trustwave. The left-hand shows the heuristic scan performed by URLQuery, indicating that ClearFake malicious JavaScript library was detected.</p> Full article ">Figure 10
<p>The LSH forest of dataset A visualised using Fearun. Known bad domains are colored red, known good are colored blue and unknown domains are colored orange.</p> Full article ">Figure 11
<p>The LSH forest of dataset B (Cloudflare CDN domains) visualised using Fearun. The TLS fingerprints have been enriched with HTTP header data. Known bad domains are colored red, known good are colored blue and unknown domains are colored orange.</p> Full article ">Figure 12
<p>The LSH forest of dataset B (Cloudflare CDN domains) visualised using Fearun. The TLS fingerpritns are not enriched and contain only TLS features. Known bad domains are colored red, known good are colored blue and unknown domains are colored orange.</p> Full article ">Figure 13
<p>The LSH visualisation of dataset C, known malicious domains. Clear similarity patterns can be seen forming by capability. Go Phish domains are seen in yellow, Cert Pl orange, Metasploit pink, Tactical RRM purple and Burp Collaborator Blue.</p> Full article ">