Interpretable Visualizations of Deep Neural Networks for Domain Generation Algorithm Detection

Becker, Franziska; Drichel, Arthur; Müller, Christoph; Ertl, Thomas

doi:10.1109/vizsec51108.2020.00010

Cited by 11 publications

(15 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In future work it is required to compare the level of explainability provided by our approach with different techniques, such as Lemna [12] and DMM-MEN [11], which try to explain the predictions of deep neural network classifiers. Moreover, recently, a visual analytics system [2] was proposed which strives to provide understandable interpretations for predictions of deep learning based DGA detection classifiers. This system first clusters the activations of a model's neurons and subsequently leverages decision trees in order to explain the constructed clusters.…”

Section: Conclusion and Discussionmentioning

confidence: 99%

“…For solving the DGA binary classification task FANCI implements an SVM and an RF-based classifier and makes use of 12 structural, 7 linguistic, and 22 statistical features. 2 The in total 41 features are extracted solely from the domain name which is to be classified and thus FANCI works completely contextless. FANCI does not support DGA multiclass classification.…”

Section: Dga Detection Classifiersmentioning

confidence: 99%

See 1 more Smart Citation

First Step Towards EXPLAINable DGA Multiclass Classification

Drichel

Faerber

Meyer

2021

Proceedings of the 16th International Conference on Availability, Reliability and Security

Self Cite

View full text Add to dashboard Cite

Numerous malware families rely on domain generation algorithms (DGAs) to establish a connection to their command and control (C2) server. Counteracting DGAs, several machine learning classifiers have been proposed enabling the identification of the DGA that generated a specific domain name and thus triggering targeted remediation measures. However, the proposed state-of-the-art classifiers are based on deep learning models. The black box nature of these makes it difficult to evaluate their reasoning. The resulting lack of confidence makes the utilization of such models impracticable. In this paper, we propose EXPLAIN, a feature-based and contextless DGA multiclass classifier. We comparatively evaluate several combinations of feature sets and hyperparameters for our approach against several state-of-the-art classifiers in a unified setting on the same real-world data. Our classifier achieves competitive results, is real-time capable, and its predictions are easier to trace back to features than the predictions made by the DGA multiclass classifiers proposed in related work. CCS CONCEPTS• Security and privacy → Intrusion/anomaly detection and malware mitigation; • Computing methodologies → Machine learning; Artificial intelligence.

show abstract

Section: Conclusion and Discussionmentioning

confidence: 99%

Section: Dga Detection Classifiersmentioning

confidence: 99%

First Step Towards EXPLAINable DGA Multiclass Classification

Drichel

Faerber

Meyer

2021

Proceedings of the 16th International Conference on Availability, Reliability and Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…Such dominant focus on visual datasets is not unique to the study of bias but is, in fact, also observed in fields like visual analytics, where non-visual aspects of the system are transformed into visual aspects. For example, the neuron activations are presented graphically (visually) in the research on network interpretability (Becker, Drichel, Müller, & Ertl, 2020) and security (Liu, Dolan-Gavitt, & Garg, 2018), which enables problem identification (detection). This in turn motivates deeper research/solutions.…”

Section: Bias and The Focus On Visual Datasetsmentioning

confidence: 99%

UnbiasedNets: a dataset diversification framework for robustness bias alleviation in neural networks

et al. 2023

View full text Add to dashboard Cite

Performance of trained neural network (NN) models, in terms of testing accuracy, has improved remarkably over the past several years, especially with the advent of deep learning. However, even the most accurate NNs can be biased toward a specific output classification due to the inherent bias in the available training datasets, which may propagate to the real-world implementations. This paper deals with the robustness bias, i.e., the bias exhibited by the trained NN by having a significantly large robustness to noise for a certain output class, as compared to the remaining output classes. The bias is shown to result from imbalanced datasets, i.e., the datasets where all output classes are not equally represented. Towards this, we propose the UnbiasedNets framework, which leverages K-means clustering and the NN’s noise tolerance to diversify the given training dataset, even from relatively smaller datasets. This generates balanced datasets and reduces the bias within the datasets themselves. To the best of our knowledge, this is the first framework catering to the robustness bias problem in NNs. We use real-world datasets to demonstrate the efficacy of the UnbiasedNets for data diversification, in case of both binary and multi-label classifiers. The results are compared to well-known tools aimed at generating balanced datasets, and illustrate how existing works have limited success while addressing the robustness bias. In contrast, UnbiasedNets provides a notable improvement over existing works, while even reducing the robustness bias significantly in some cases, as observed by comparing the NNs trained on the diversified and original datasets.

show abstract

“…The explanation is attributable to subgraph decomposition theory [198], where it is feasible to determine whether the learned model is interpretable by identifying the subgraph with the most significant influence on prediction and judging whether the subgraph is faithful to general knowledge. [199]- [201], three explainable studies focused on DGAbased botnet detection, are also worth mentioning, as is [202],in which the authors created a Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection utilizing a BotNet dataset as a test.…”

Section: ) Explainable Artificial Intelligence In Bot(net) Detectionmentioning

confidence: 99%

Explainable Artificial Intelligence in CyberSecurity: A Survey

et al. 2022

View full text Add to dashboard Cite

Nowadays, Artificial Intelligence (AI) is widely applied in every area of human being's daily life. Despite the AI benefits, its application suffer from the opacity of complex internal mechanisms and doesn't satisfy by design the principles of Explainable Artificial Intelligence (XAI). The lack of transparency further exacerbates the problem in the field of Cybersecurity because entrusting crucial decisions to a system that cannot explain itself presents obvious dangers. There are several methods in the literature capable of providing explainability of AI results. Anyway, the application of XAI in Cybersecurity can be a doubleedged sword. It substantially improves the Cybersecurity practices but simultaneously leaves the system vulnerable to adversary attacks. Therefore, there is a need to analyze the state-of-the-art of XAI methods in Cybersecurity to provide a clear vision for future research. This study presents an in-depth examination of the application of XAI in Cybersecurity. It considers more than 300 papers to comprehensively analyze the main Cybersecurity application fields, like Intrusion Detection Systems,Malware detection, Phishing and Spam detection, BotNets detection, Fraud detection, Zero-Day vulnerabilities, Digital Forensics and Crypto-Jacking . Specifically, this study focuses on the explainability methods adopted or proposed in these fields, pointing out promising works and new challenges.

show abstract

Interpretable Visualizations of Deep Neural Networks for Domain Generation Algorithm Detection

Cited by 11 publications

References 21 publications

First Step Towards EXPLAINable DGA Multiclass Classification

First Step Towards EXPLAINable DGA Multiclass Classification

UnbiasedNets: a dataset diversification framework for robustness bias alleviation in neural networks

Explainable Artificial Intelligence in CyberSecurity: A Survey

Contact Info

Product

Resources

About