Detection of algorithmically generated domain names used by botnets
| Autor: | Jan Spooren, Peter Janssen, Wouter Joosen, Lieven Desmet, Davy Preuveneers |
|---|---|
| Přispěvatelé: | Hung, Chih-Cheng, Papadopoulos, George A |
| Rok vydání: | 2019 |
| Předmět: |
Feature engineering
business.industry Computer science Deep learning Botnet 020207 software engineering 02 engineering and technology Machine learning computer.software_genre Random forest Recurrent neural network 020204 information systems 0202 electrical engineering electronic engineering information engineering Malware Artificial intelligence business computer Classifier (UML) |
| Zdroj: | SAC |
| Popis: | Malware typically uses Domain Generation Algorithms (DGAs) as a mechanism to contact their Command and Control server. In recent years, different approaches to automatically detect generated domain names have been proposed, based on machine learning. The first problem that we address is the difficulty to systematically compare these DGA detection algorithms due to the lack of an independent benchmark. The second problem that we investigate is the difficulty for an adversary to circumvent these classifiers when the machine learning models backing these DGA-detectors are known. In this paper we compare two different approaches on the same set of DGAs: classical machine learning using manually engineered features and a ‘deep learning’ recurrent neural network. We show that the deep learning approach performs consistently better on all of the tested DGAs, with an average classification accuracy of 98.7% versus 93.8% for the manually engineered features. We also show that one of the dangers of manual feature engineering is that DGAs can adapt their strategy, based on knowledge of the features used to detect them. To demonstrate this, we use the knowledge of the used feature set to design a new DGA which makes the random forest classifier powerless with a classification accuracy of 59.9%. The deep learning classifier is also (albeit less) affected, reducing its accuracy to 85.5%. ispartof: pages:1916-1923 ispartof: Proceedings of the 34rd ACM/SIGAPP Symposium On Applied Computing vol:Part F147772 pages:1916-1923 ispartof: The 34rd ACM/SIGAPP Symposium On Applied Computing location:Limassol, Cyprus date:8 Apr - 12 Apr 2019 status: Published online |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|