Detecting Word Based DGA Domains Using Ensemble Models

Charan, P.V. Sai; Shukla, Sandeep K.; Anand, P. Mohan

doi:10.1007/978-3-030-65411-5_7

Cited by 6 publications

(2 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The proposed model can detect character-based DGA domain names with a decent accuracy score of 97%. Charan et al [24] proposed a similar technique to detect word-based DGA domain names where domain names are constructed by concatenating two or three words from dictionaries, for example crossmentioncare.com. In their model, the author consider lexical, statistical, network-based features to build an ensemble classifier.…”

Section: Ensemble Models For C2c Communication Detectionmentioning

confidence: 99%

DMAPT: Study of Data Mining and Machine Learning Techniques in Advanced Persistent Threat Attribution and Detection

Charan¹,

Anand²,

Shukla³

2022

Artificial Intelligence

View full text Add to dashboard Cite

Modern-day malware is intelligent enough to hide its presence and perform stealthy operations in the background. Advance Persistent Threat (APT) is one such kind of malware attack on sensitive corporate and banking networks to stay there for a long time undetected. In real-time corporate networks, identifying the presence of intruders is a big challenging task for security experts. Recent APT attacks like Carbanak, The Big Bang, and Red Echo attack (targeting the Indian power sector) are ringing alarms globally. New data exfiltration methods and advancements in malware techniques are the two main reasons for rapid and robust APT evolution. Although many traditional and hybrid methods are available to detect this stealthy malware, the number of target-specific attacks are increasing rapidly at global level. Attackers have been crafting payloads resistant to malware sandbox environments so that traditional sandboxing techniques may not work with these APT malware detection. In this paper, we shed light on various Data Mining, Machine Learning techniques and frameworks used in both Attribution and Detection of APT malware. Added to this, our work highlight GAP analysis and need for paradigm shift in existing techniques to deal with evolving modern APT malware.

show abstract

Section: Ensemble Models For C2c Communication Detectionmentioning

confidence: 99%

DMAPT: Study of Data Mining and Machine Learning Techniques in Advanced Persistent Threat Attribution and Detection

Charan¹,

Anand²,

Shukla³

2022

Artificial Intelligence

View full text Add to dashboard Cite

show abstract

“…The approach uses lexical and statistical features (such as N-gram and character occurrence frequency in DNs). In follow-up work, in [11], the authors present an ML-based method for detecting the malicious Word-list-based DGA DNs based on lexical and network-based features (such as created since, updated since, registrar, and Time-to-Live (TTL)).…”

Section: Related Workmentioning

confidence: 99%

Identifying malicious accounts in Blockchains using Domain Names and associated temporal properties

Sachan,

Agarwal,

Shukla

2021

Preprint

View full text Add to dashboard Cite

The rise in the adoption of blockchain technology has led to increased illegal activities by cyber-criminals costing billions of dollars. Many machine learning algorithms are applied to detect such illegal behavior. These algorithms are often trained on the transaction behavior and, in some cases, trained on the vulnerabilities that exist in the system. In our approach, we study the feasibility of using metadata such as Domain Name (DN) associated with the account in the blockchain and identify whether an account should be tagged malicious or not. Here, we leverage the temporal aspects attached to the DNs. Our results identify 144930 DNs that show malicious behavior, and out of these, 54114 DNs show persistent malicious behavior over time. Nonetheless, none of these identified malicious DNs were reported in new officially tagged malicious blockchain DNs.

show abstract