DGASensor

Luo, Xi; Wang, Liming; Xu, Zhen; Yang, Jing; Sun, Min; Wang, Jing

doi:10.1145/3057109.3057112

Cited by 16 publications

(4 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Examples of DNS data trails include domain names, resource code, DNS responses, DNS queries, and timestamps. Such DNS data trails' availability provides security researchers with ways to detect botnets and their C&C servers (Stevanovic et al, 2012;Luo et al, 2017).…”

Section: Initial Infection and Propagation Phasementioning

confidence: 99%

“…Initially, the enriched training dataset is the input for both PART and JRip classifiers. Then, to properly assess the predictive performance and overcome any bias in this process, the k-fold cross-validation training technique is used with the value of k set to 10 to build and test the model (Luo et al, 2017). Figure 14 illustrates the rules extraction process in this stage.…”

Section: Design Of Rule-based Detection Stagementioning

confidence: 99%

“…Secondly, the botmaster could use DGA as a fail-safe or backup channel when the primary communication channel fails (Stone-Gross et al, 2011). The Zeus worm (Luo et al, 2017) is one of the worms that employs DGA.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

Al-Mashhadi

Anbar

Hasbullah

et al. 2021

PeerJ Computer Science

View full text Add to dashboard Cite

Botnets can simultaneously control millions of Internet-connected devices to launch damaging cyber-attacks that pose significant threats to the Internet. In a botnet, bot-masters communicate with the command and control server using various communication protocols. One of the widely used communication protocols is the ‘Domain Name System’ (DNS) service, an essential Internet service. Bot-masters utilise Domain Generation Algorithms (DGA) and fast-flux techniques to avoid static blacklists and reverse engineering while remaining flexible. However, botnet’s DNS communication generates anomalous DNS traffic throughout the botnet life cycle, and such anomaly is considered an indicator of DNS-based botnets presence in the network. Despite several approaches proposed to detect botnets based on DNS traffic analysis; however, the problem still exists and is challenging due to several reasons, such as not considering significant features and rules that contribute to the detection of DNS-based botnet. Therefore, this paper examines the abnormality of DNS traffic during the botnet lifecycle to extract significant enriched features. These features are further analysed using two machine learning algorithms. The union of the output of two algorithms proposes a novel hybrid rule detection model approach. Two benchmark datasets are used to evaluate the performance of the proposed approach in terms of detection accuracy and false-positive rate. The experimental results show that the proposed approach has a 99.96% accuracy and a 1.6% false-positive rate, outperforming other state-of-the-art DNS-based botnet detection approaches.

show abstract

Section: Initial Infection and Propagation Phasementioning

confidence: 99%

Section: Design Of Rule-based Detection Stagementioning

confidence: 99%

See 1 more Smart Citation

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

Al-Mashhadi

Anbar

Hasbullah

et al. 2021

PeerJ Computer Science

View full text Add to dashboard Cite

show abstract

“…Below we briefly describe each of these feature representations. [22,24], (3) ratio of meaningful words [7,32], and (4) domain character entropy (randomness) [13,32]. Since DGAs are simlar to random string generators, character entropy provides good indication whether or not a domain is from a DGA.…”

Section: Related Workmentioning

confidence: 99%

Helix

Sidi

Mirsky

Nadler

et al. 2020

Proceedings of the 29th ACM International Conference on Information &Amp; Knowledge Management

View full text Add to dashboard Cite

Botnets have been using domain generation algorithms (DGA) for over a decade to covertly and robustly identify the domain name of their command and control servers (C&C). Recent advancements in DGA detection has motivated botnet owners to rapidly alter the C&C domain and use adversarial techniques to evade detection. As a result, it has become increasingly difficult to track botnets in DNS traffic. In this paper, we present Helix, a method for tracking and exploring botnets. Helix uses a spatio-temporal deep neural network autoencoder to convert domains into numerical vectors (embeddings) which capture the DGA and seed used to create the domain. This is made possible by leveraging both convolutional (spatial) and recurrent (temporal) layers, and by using techniques such as attention mechanisms and highways. Furthermore, by using an autoencoder architecture, the network can be trained in an unsupervised manner (no labeling of data) which makes the system practical for real world deployments. In our evaluation, we found that Helix can track botnet campaigns, distinguish between DGA families and seeds, and can identify domains generated using the latest adversarial machine learning techniques. Helix is currently being used to track botnets in one of the world's largest Internet Service Providers (ISP), and we include some of the ISP's analysis work using our method. CCS CONCEPTS • Security and privacy → Intrusion/anomaly detection and malware mitigation.

show abstract

LagProber: Detecting DGA-Based Malware by Using Query Time Lag of Non-existent Domains

Luo

Wang

et al. 2018

Information and Communications Security

View full text Add to dashboard Cite

DGASensor

Cited by 16 publications

References 8 publications

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

Helix

LagProber: Detecting DGA-Based Malware by Using Query Time Lag of Non-existent Domains

Contact Info

Product

Resources

About