Title
AI-based detection of DNS misuse for network security
Author
Chiscop, I.
Soro, F.
Smith, P.
Publication year
2022
Abstract
Threat hunting and malware prediction are critical activities to ensure network and system security. These tasks are difficult due to increasing numbers of sophisticated malware families. Automatically detecting anomalous Domain Name System (DNS) queries in operational traffic facilitates the detection of new malware infections, significantly contributing to the work of security practitioners. In this paper, we present two AI-based Domain Generation Algorithm (DGA) detection and classification techniques - a feature-based one, leveraging classic Machine Learning algorithms and a featureless one, based on Deep Learning - specifically intended to aid in this task. Both techniques are designed to be integrated in operational environments, dealing with hundreds of thousands to millions of new malware samples per day. We report the implementation details, the classification performance, the advantages and shortcomings for both techniques, as well as experiences from the deployment of this system in an industrial environment. We show that both techniques reach more than the 90% of accuracy in the case of binary DGA detection, with a slight degradation in performance in the multi-class classification case, in which the results strongly depend on the malware type. (C) 2022 Association for Computing Machinery.
Subject
Intrusion Detection
Malware Identification
Threat Intelligence
Classification (of information)
Deep learning
Internet protocols
Intrusion detection
Learning algorithms
Network security
Critical activities
Domain name system
Generation algorithm
Intrusion-Detection
Malware identification
Malwares
Networks and systems
Networks security
System security
Threat intelligence
Malware
To reference this document use:
http://resolver.tudelft.nl/uuid:c904b8c0-b936-455c-952f-326f1327318b
DOI
https://doi.org/10.1145/3565009.3569523
TNO identifier
980953
Publisher
Association for Computing Machinery, Inc
ISBN
9781450398879
Source
NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022, 27-32
Document type
conference paper