Enhanced Domain Generating Algorithm Detection Based on Deep Neural Networks

Kumar, Amara Dinesh; Thodupunoori, Harish; Ravi, Vinayakumar; Poornachandran, Prabaharan; Alazab, Mamoun; Venkatraman, Sitalakshmi

doi:10.1007/978-3-030-13057-2_7

Cited by 11 publications

(7 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…DGAs have been found to evolve over time, varying their generation algorithms slightly or using entirely new dictionaries [50]. While our tests for generalisability highlight some of the deep learning models' ability to classify alterations in the dictionary DGA, they are limited by our scope of sampling in 2016-17.…”

Section: Testing Time-based Resiliencymentioning

confidence: 96%

“…Much like the work by Kumar et al [50] and Vinayakumar et al [16], we aim to not only address this cyber security issue with text classification techniques, but also the greater system in which the model would be deployed. Prior systems consider the various model performance metrics on common data sets as well as the real-world generalisability, response time, and scalability of their chosen model when scoring domains in real time.…”

Section: Real-time Deployment Environmentmentioning

confidence: 99%

See 1 more Smart Citation

Real-Time Detection of Dictionary DGA Network Traffic Using Deep Learning

Highnam

Puzio²,

Luo

et al. 2021

SN COMPUT. SCI.

View full text Add to dashboard Cite

Botnets and malware continue to avoid detection by static rule engines when using domain generation algorithms (DGAs) for callouts to unique, dynamically generated web addresses. Common DGA detection techniques fail to reliably detect DGA variants that combine random dictionary words to create domain names that closely mirror legitimate domains. To combat this, we created a novel hybrid neural network, Bilbo the “bagging” model, that analyses domains and scores the likelihood they are generated by such algorithms and therefore are potentially malicious. Bilbo is the first parallel usage of a convolutional neural network (CNN) and a long short-term memory (LSTM) network for DGA detection. Our unique architecture is found to be the most consistent in performance in terms of AUC, $$F_1$$ F 1 score, and accuracy when generalising across different dictionary DGA classification tasks compared to current state-of-the-art deep learning architectures. We validate using reverse-engineered dictionary DGA domains and detail our real-time implementation strategy for scoring real-world network logs within a large enterprise. In 4 h of actual network traffic, the model discovered at least five potential command-and-control networks that commercial vendor tools did not flag.

show abstract

Section: Testing Time-based Resiliencymentioning

confidence: 96%

Section: Real-time Deployment Environmentmentioning

confidence: 99%

Real-Time Detection of Dictionary DGA Network Traffic Using Deep Learning

Highnam

Puzio²,

Luo

et al. 2021

SN COMPUT. SCI.

View full text Add to dashboard Cite

show abstract

“…Both AmritaDGA and AmritaDeepDGA have been made publically available for further research. Various DL architectures such as RNN, LSTM, GRU, CNN-LSTM, BRNN and BLSTM were employed for DGA detection and classification using AmritaDGA data set [606].…”

Section: A Deep Learning In Intrusion Detectionmentioning

confidence: 99%

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Ravi¹,

Alazab²,

Sriram³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Much like the work by Kumar et al [24] and Vinayakumar et al [48], we aim to not only address this cyber security issue with text classi cation techniques, but also the greater system in which the model would be deployed. Prior systems consider the various model performance metrics on common data sets as well as the realworld generalisability, response time, and scalability of their chosen model when scoring domains in real time.…”

Section: Real-time Deployment Environmentmentioning

confidence: 99%

Real-Time Detection of Dictionary DGA Network Traffic using Deep Learning

Highnam¹,

Puzio²,

Luo³

et al. 2020

Preprint

View full text Add to dashboard Cite

Botnets and malware continue to avoid detection by static rules engines when using domain generation algorithms (DGAs) for callouts to unique, dynamically generated web addresses. Common DGA detection techniques fail to reliably detect DGA variants that combine random dictionary words to create domain names that closely mirror legitimate domains. To combat this, we created a novel hybrid neural network, Bilbo the bagging model, that analyses domains and scores the likelihood they are generated by such algorithms and therefore are potentially malicious. Bilbo is the rst parallel usage of a convolutional neural network (CNN) and a long short-term memory (LSTM) network for DGA detection. Our unique architecture is found to be the most consistent in performance in terms of AUC, F 1 score, and accuracy when generalising across di erent dictionary DGA classi cation tasks compared to current state-of-the-art deep learning architectures. We validate using reverse-engineered dictionary DGA domains and detail our real-time implementation strategy for scoring real-world network logs within a large enterprise 1 . In four hours of actual network tra c, the model discovered at least ve potential command-andcontrol networks that commercial vendor tools did not ag.

show abstract

Enhanced Domain Generating Algorithm Detection Based on Deep Neural Networks

Cited by 11 publications

References 21 publications

Real-Time Detection of Dictionary DGA Network Traffic Using Deep Learning

Real-Time Detection of Dictionary DGA Network Traffic Using Deep Learning

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Real-Time Detection of Dictionary DGA Network Traffic using Deep Learning

Contact Info

Product

Resources

About