AI-based detection of DNS misuse for network security
conference paper
Threat hunting and malware prediction are critical activities to ensure network and system security. These tasks are difficult due to increasing numbers of sophisticated malware families. Automatically detecting anomalous Domain Name System (DNS) queries in operational traffic facilitates the detection of new malware infections, significantly contributing to the work of security practitioners. In this paper, we present two AI-based Domain Generation Algorithm (DGA) detection and classification techniques - a feature-based one, leveraging classic Machine Learning algorithms and a featureless one, based on Deep Learning - specifically intended to aid in this task. Both techniques are designed to be integrated in operational environments, dealing with hundreds of thousands to millions of new malware samples per day. We report the implementation details, the classification performance, the advantages and shortcomings for both techniques, as well as experiences from the deployment of this system in an industrial environment. We show that both techniques reach more than the 90% of accuracy in the case of binary DGA detection, with a slight degradation in performance in the multi-class classification case, in which the results strongly depend on the malware type. (C) 2022 Association for Computing Machinery.
Topics
Intrusion DetectionMalware IdentificationThreat IntelligenceClassification (of information)Deep learningInternet protocolsIntrusion detectionLearning algorithmsNetwork securityCritical activitiesDomain name systemGeneration algorithmIntrusion-DetectionMalware identificationMalwaresNetworks and systemsNetworks securitySystem securityThreat intelligenceMalware
TNO Identifier
980953
ISBN
9781450398879
Publisher
Association for Computing Machinery, Inc
Source title
NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022
Pages
27-32
Files
To receive the publication files, please send an e-mail request to TNO Repository.