Character Level based Detection of DGA Domain Names

Yu, Bin; Pan, Jie; Hu, Jiaming; Nascimento, Anderson C. A.; Cock, Martine De

doi:10.1109/ijcnn.2018.8489147

Cited by 97 publications

(113 citation statements)

References 7 publications

Supporting

Mentioning

103

Contrasting

Order By: Relevance

“…Yu et al [56] performed a comparative analysis on convolutional neural network (CNN) and recurrent neural network (RNN) based architectures, tested using a dataset with one million domain names. The authors reported that all comparative models performed well with high accuracy rates and low false positive rates.…”

Section: Identifying Domain Names Generated By Dgasmentioning

confidence: 99%

Artificial Intelligence in the Cyber Domain: Offense and Defense

2020

View full text Add to dashboard Cite

Artificial intelligence techniques have grown rapidly in recent years, and their applications in practice can be seen in many fields, ranging from facial recognition to image analysis. In the cybersecurity domain, AI-based techniques can provide better cyber defense tools and help adversaries improve methods of attack. However, malicious actors are aware of the new prospects too and will probably attempt to use them for nefarious purposes. This survey paper aims at providing an overview of how artificial intelligence can be used in the context of cybersecurity in both offense and defense.

show abstract

Section: Identifying Domain Names Generated By Dgasmentioning

confidence: 99%

Artificial Intelligence in the Cyber Domain: Offense and Defense

2020

View full text Add to dashboard Cite

show abstract

“…There are for instance techniques that retrospectively analyze entire groups of domains extracted from DNS queries that occurred in a certain time window [2], [11] vs. techniques that can classify individual domain names in real-time [3], [5]. There are ML models that only expect the domain name string itself [3], [4], [8] as input vs. ML models that exploit additional context features such as the IPaddresses that the domains are mapped to, or temporal access patterns (e.g. how often the domain was requested, and when) [6], [11]- [13].…”

Section: Related Workmentioning

confidence: 99%

“…Popular kinds of classifiers used in the featureful approach for DGA detection are logistic regression and tree ensemble methods, while the featureless approach relies on the use of deep neural networks, namely Long Short-Term Memory (LSTM) networks and Convolutional Neural Networks (CNN). Most papers about the featureless approach include a featureful approach as a baseline method [3], [7], [8], [10], [14], and the featureless approach is typically reported to yield better, more accurate results. A note of caution is that in supervised learning in general, the predictive performance of feature based methods heavily relies on the choice of features, and that authors who want to highlight the benefits of featureless, deep learning approaches, might not necessarily go out of their way to carefully select and craft features to strengthen the featureful baseline approach.…”

Section: Related Workmentioning

confidence: 99%

“…The output from the forward and the backward layer is then combined and passed on to further layers. We use the same B-CMU classifier architecture as Yu et al [8], who adapted the bidirectional LSTM that was originally proposed for tweet classification by Dhingra et al [17] to the problem of DGA detection. • B-MIT: This B-MIT classifier is a hybrid neural network consisting of an embedding layer, a CNN layer with 128 filters and 'ReLU' as the activation function, followed by an LSTM layer with 64 LSTM cells.…”

Section: B Featureless Approachmentioning

confidence: 99%

“…Unsurprisingly, existing work on the development of DGA classifiers has drawn inspiration from the field of natural language processing. This includes both methods that leverage human defined lexical features extracted from domain names [5], [6], as well as deep learning methods that learn important features automatically as part of the training process [3], [7], [8].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An Evaluation of DGA Classifiers

Sivaguru

Choudhary

Yu³

et al. 2018

2018 IEEE International Conference on Big Data (Big Data)

Self Cite

View full text Add to dashboard Cite

Domain Generation Algorithms (DGAs) are a popular technique used by contemporary malware for commandand-control (C&C) purposes. Such malware utilizes DGAs to create a set of domain names that, when resolved, provide information necessary to establish a link to a C&C server. Automated discovery of such domain names in real-time DNS traffic is critical for network security as it allows to detect infection, and, in some cases, take countermeasures to disrupt the communication and identify infected machines. Detection of the specific DGA malware family provides the administrator valuable information about the kind of infection and steps that need to be taken. In this paper we compare and evaluate machine learning methods that classify domain names as benign or DGA, and label the latter according to their malware family. Unlike previous work, we select data for test and training sets according to observation time and known seeds. This allows us to assess the robustness of the trained classifiers for detecting domains generated by the same families at a different time or when seeds change. Our study includes tree ensemble models based on human-engineered features and deep neural networks that learn features automatically from domain names. We find that all state-of-the-art classifiers are significantly better at catching domain names from malware families with a time-dependent seed compared to time-invariant DGAs. In addition, when applying the trained classifiers on a day of real traffic, we find that many domain names unjustifiably are flagged as malicious, thereby revealing the shortcomings of relying on a standard whitelist for training a production grade DGA detection system.

show abstract

Explainable artificial intelligence envisioned security mechanism for cyber threat hunting

Kumar

Wazid

Singh

et al. 2023

Security and Privacy

View full text Add to dashboard Cite

Cyber threat hunting proactively searches for cyber threats, which are undetected by the traditional defense mechanisms. It scans deep to identify malicious programs (ie, malware) that escape from detection. It is important because sophisticated cyber threats can bypass the cyber security mechanisms. The performance of the cyber threat hunting can be improved through artificial intelligence (AI), especially, explainable AI (XAI), which adds trust component to the cyber threat hunting process. Due to the inclusion of XAI, the security experts get the full explanations of the detected threats as the working of the detection model in XAI is known. Information, like, which one is a threat, how it has been detected, and why it has been detected, can be obtained very easily due to the inclusion of XAI in the cyber threat hunting. Therefore, an XAI‐envisioned mechanism for cyber threat hunting has been proposed (in short, XAISM‐CTH). The network and threat models of XAISM‐CTH are designed and discussed. The conducted security analysis proves the security of XAISM‐CTH against various potential attacks. XAISM‐CTH also performs better than the other existing schemes. At the end, a practical implementation of XAISM‐CTH has been provided to observe its impact on the performance of the system.

show abstract

Character Level based Detection of DGA Domain Names

Cited by 97 publications

References 7 publications

Artificial Intelligence in the Cyber Domain: Offense and Defense

Artificial Intelligence in the Cyber Domain: Offense and Defense

An Evaluation of DGA Classifiers

Explainable artificial intelligence envisioned security mechanism for cyber threat hunting

Contact Info

Product

Resources

About