Abstract: A computer-implemented method for linking combo-squatting domains is provided. The method includes grouping domain names into nameserver groups based on a nameserver for each of the domains. Each of the domain names contain valued words. The method also includes splitting words in each domain name and generating a wordlist for each of the nameserver groups. The method further includes finding feature words among the nameserver groups, and extracting malicious domain names which contain the feature words in each of the nameserver groups. The method further includes outputting, for each of the nameserver groups, the malicious domain names and corresponding registrant identifying data based on the feature words.

Abstract: In an approach to detection of co-location of container services, a method may include monitoring a load on one or more resources accessible by cloud containers located on a first host. The method may further include identifying a bit string from the monitored load of the one or more resources. A high load on the one or more resources for a time period indicates a first bit value, and a low load on the one or more resources for the time period indicates a second alternate bit value. The method may further include receiving a shared key corresponding to a second program in a second cloud container. The method may further include determining the second cloud container is located on the first host based on the shared key matching a key corresponding to the identified bit string.

Abstract: A computer-implemented method for linking combo-squatting domains is provided. The method includes grouping domain names into nameserver groups based on a nameserver for each of the domains. Each of the domain names contain valued words. The method also includes splitting words in each domain name and generating a wordlist for each of the nameserver groups. The method further includes finding feature words among the nameserver groups, and extracting malicious domain names which contain the feature words in each of the nameserver groups. The method further includes outputting, for each of the nameserver groups, the malicious domain names and corresponding registrant identifying data based on the feature words.

Abstract: In an approach to detection of co-location of container services, a method may include monitoring a load on one or more resources accessible by cloud containers located on a first host. The method may further include identifying a bit string from the monitored load of the one or more resources. A high load on the one or more resources for a time period indicates a first bit value, and a low load on the one or more resources for the time period indicates a second alternate bit value. The method may further include receiving a shared key corresponding to a second program in a second cloud container. The method may further include determining the second cloud container is located on the first host based on the shared key matching a key corresponding to the identified bit string.

Abstract: In an approach to detection of co-location of container services, a method may include receiving, by a first program in a first cloud container on a first host, a bit string over a side channel within a trial period of time. The method may also include determining whether a key corresponding to the bit string matches a pre-determined key corresponding to a second program in a second cloud container. The method may further include determining whether the second cloud container is located on the first host based, at least in part, on whether the key corresponding to the bit string matches the pre-determined key. The side channel may include a first resource on the first host that is accessible by cloud containers located on the first host and the bit string is received by monitoring the first resource for activity indicative of bit values.

Abstract: In an approach to detection of co-location of container services, a method may include receiving, by a first program in a first cloud container on a first host, a bit string over a side channel within a trial period of time. The method may also include determining whether a key corresponding to the bit string matches a pre-determined key corresponding to a second program in a second cloud container. The method may further include determining whether the second cloud container is located on the first host based, at least in part, on whether the key corresponding to the bit string matches the pre-determined key. The side channel may include a first resource on the first host that is accessible by cloud containers located on the first host and the bit string is received by monitoring the first resource for activity indicative of bit values.