Detecting Unknown DGAs Using Distances Between Feature Vectors of Domain Names

Huan, Jun; Zhang, Yongzheng; Chang, Peng; Tuo, Yupeng

doi:10.1109/ict52184.2021.9511517

Cited by 1 publication

(5 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors consider the additional layer as crucial for the detection of new DGAs. However, this model modification leads to a significant drop in recall and F1-score for known DGA families compared to an unmodified one-vs-rest variant of the Endgame binary classification model [13].…”

Section: Unknown Dga Detectionmentioning

confidence: 99%

“…The related work for unknown DGA detection can be split into two fields: (1) the correct classification of domains generated by unknown DGAs as malicious domains in a binary classification setting (e.g., [7,20]), and (2) the detection of domains generated by unknown DGAs and their correct attribution to the unknown class in a multiclass classification setting (e.g., [2,13]).…”

Section: Unknown Dga Detectionmentioning

confidence: 99%

“…Additionally, the classifiers may need to adapt to newly found classes. In the context of DGA multiclass classification, two approaches to new DGA detection ( [2,13]) have already been proposed in the past, which we discuss in the following.…”

Section: Unknown Dga Detectionmentioning

confidence: 99%

“…2.1.2 Talos. Huang et al [13] proposed Talos, a context-less and deep learning based system for detecting new DGAs in the DGA multiclass classification setting. Talos takes up the idea of leveraging feature vectors extracted from the early-layers of a deep neural network, which has proven to be good for detecting OOD samples in different application domains (e.g., [1,5,15]), and performs simple clustering.…”

Section: Unknown Dga Detectionmentioning

confidence: 99%

“…Vector. This approach leverages the idea of clustering the feature vectors extracted from the early-layers of a deep neural network presented in [13]. For training, a conventionally trained deep learning classifier is fed the entire training set one more time and the output from the early-layers is collected (cf.…”

Section: Familymentioning

confidence: 99%

See 4 more Smart Citations

Detecting Unknown DGAs without Context Information

Drichel,

von Brandt,

Meyer

2022

Preprint

View full text Add to dashboard Cite

New malware emerges at a rapid pace and often incorporates Domain Generation Algorithms (DGAs) to avoid blocking the malware's connection to the command and control (C2) server. Current state-of-the-art classifiers are able to separate benign from malicious domains (binary classification) and attribute them with high probability to the DGAs that generated them (multiclass classification). While binary classifiers can label domains of yet unknown DGAs as malicious, multiclass classifiers can only assign domains to DGAs that are known at the time of training, limiting the ability to uncover new malware families. In this work, we perform a comprehensive study on the detection of new DGAs, which includes an evaluation of 59,690 classifiers. We examine four different approaches in 15 different configurations and propose a simple yet effective approach based on the combination of a softmax classifier and regular expressions (regexes) to detect multiple unknown DGAs with high probability. At the same time, our approach retains state-of-the-art classification performance for known DGAs. Our evaluation is based on a leave-one-group-out cross-validation with a total of 94 DGA families. By using the maximum number of known DGAs, our evaluation scenario is particularly difficult and close to the real world. All of the approaches examined are privacy-preserving, since they operate without context and exclusively on a single domain to be classified. We round up our study with a thorough discussion of class-incremental learning strategies that can adapt an existing classifier to newly discovered classes. CCS CONCEPTS• Security and privacy → Intrusion detection systems; • Computing methodologies → Machine learning.

show abstract

Section: Unknown Dga Detectionmentioning

confidence: 99%

Section: Unknown Dga Detectionmentioning

confidence: 99%

Section: Unknown Dga Detectionmentioning

confidence: 99%

Section: Unknown Dga Detectionmentioning

confidence: 99%

Section: Familymentioning

confidence: 99%

See 3 more Smart Citations

Detecting Unknown DGAs without Context Information

Drichel,

von Brandt,

Meyer

2022

Preprint

View full text Add to dashboard Cite

show abstract

Detecting Unknown DGAs Using Distances Between Feature Vectors of Domain Names

Cited by 1 publication

References 7 publications

Detecting Unknown DGAs without Context Information

Detecting Unknown DGAs without Context Information

Contact Info

Product

Resources

About