  DNS is an essential Internet infrastructure to support network applications
and services, but is also a significant tool exploited by various cyberattacks.
Existing DNS security analysis techniques mostly focus on one specific task
associated with one single entity (e.g., domain) via conventional feature
engineering. They rely heavily on the labor-intensive feature selection and
largely ignore the intrinsic correlations among the heterogeneous DNS entities
(e.g., domain and IP). In this paper, I explore the potential of heterogeneous
graph embedding to automatically learn the behavior features of multiple DNS
entities, and to simultaneously support more than one security tasks.
Considering the joint optimization of malicious domain detection and IP
reputation evaluation as an example, I propose a novel joint DNS embedding
(JDE) model to formulate the DNS query behavior via a similarity-enhanced graph
with heterogeneous entities. The random walk technique is applied to the
heterogeneous graph to comprehensively explore the hidden homogeneous and
heterogeneous high-order proximities among domains and IPs. Extensive
experiments on real DNS traffic demonstrate that the joint optimization of
multiple tasks with the latent high-order proximities can lead to better
security analysis performance for all the tasks than respectively optimizing
each single task with the observable low-order proximity.
