Home > Research > Publications & Outputs > AI-based detection of DNS misuse for network se...

Associated organisational unit

View graph of relations

AI-based detection of DNS misuse for network security

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSNConference contribution/Paperpeer-review

Published
Close
Publication date9/12/2022
Host publicationNativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022
Place of PublicationNew York
PublisherAssociation for Computing Machinery (ACM)
Pages27-32
Number of pages6
ISBN (electronic)9781450398879
<mark>Original language</mark>English
Event1st International Workshop on Native Network Intelligence - Rome, Italy
Duration: 9/12/2022 → …

Workshop

Workshop1st International Workshop on Native Network Intelligence
Country/TerritoryItaly
CityRome
Period9/12/22 → …

Publication series

NameNativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022

Workshop

Workshop1st International Workshop on Native Network Intelligence
Country/TerritoryItaly
CityRome
Period9/12/22 → …

Abstract

Threat hunting and malware prediction are critical activities to ensure network and system security. These tasks are difficult due to increasing numbers of sophisticated malware families. Automatically detecting anomalous Domain Name System (DNS) queries in operational traffic facilitates the detection of new malware infections, significantly contributing to the work of security practitioners. In this paper, we present two AI-based Domain Generation Algorithm (DGA) detection and classification techniques - a feature-based one, leveraging classic Machine Learning algorithms and a featureless one, based on Deep Learning - specifically intended to aid in this task. Both techniques are designed to be integrated in operational environments, dealing with hundreds of thousands to millions of new malware samples per day. We report the implementation details, the classification performance, the advantages and shortcomings for both techniques, as well as experiences from the deployment of this system in an industrial environment. We show that both techniques reach more than the 90% of accuracy in the case of binary DGA detection, with a slight degradation in performance in the multi-class classification case, in which the results strongly depend on the malware type.