Standard
AI-based detection of DNS misuse for network security. / Chiscop, Irina; Soro, Francesca
; Smith, Paul.
NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022. New York: Association for Computing Machinery (ACM), 2022. p. 27-32 (NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022).
Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSN › Conference contribution/Paper › peer-review
Harvard
Chiscop, I, Soro, F
& Smith, P 2022,
AI-based detection of DNS misuse for network security. in
NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022. NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022, Association for Computing Machinery (ACM), New York, pp. 27-32, 1st International Workshop on Native Network Intelligence, Rome, Italy,
9/12/22.
https://doi.org/10.1145/3565009.3569523APA
Vancouver
Chiscop I, Soro F
, Smith P.
AI-based detection of DNS misuse for network security. In NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022. New York: Association for Computing Machinery (ACM). 2022. p. 27-32. (NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022). doi: 10.1145/3565009.3569523
Author
Chiscop, Irina ; Soro, Francesca
; Smith, Paul. /
AI-based detection of DNS misuse for network security. NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022. New York : Association for Computing Machinery (ACM), 2022. pp. 27-32 (NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022).
Bibtex
@inproceedings{03c12cd127b04af8a5478ff601d818c7,
title = "AI-based detection of DNS misuse for network security",
abstract = "Threat hunting and malware prediction are critical activities to ensure network and system security. These tasks are difficult due to increasing numbers of sophisticated malware families. Automatically detecting anomalous Domain Name System (DNS) queries in operational traffic facilitates the detection of new malware infections, significantly contributing to the work of security practitioners. In this paper, we present two AI-based Domain Generation Algorithm (DGA) detection and classification techniques - a feature-based one, leveraging classic Machine Learning algorithms and a featureless one, based on Deep Learning - specifically intended to aid in this task. Both techniques are designed to be integrated in operational environments, dealing with hundreds of thousands to millions of new malware samples per day. We report the implementation details, the classification performance, the advantages and shortcomings for both techniques, as well as experiences from the deployment of this system in an industrial environment. We show that both techniques reach more than the 90% of accuracy in the case of binary DGA detection, with a slight degradation in performance in the multi-class classification case, in which the results strongly depend on the malware type.",
author = "Irina Chiscop and Francesca Soro and Paul Smith",
year = "2022",
month = dec,
day = "9",
doi = "10.1145/3565009.3569523",
language = "English",
series = "NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022",
publisher = "Association for Computing Machinery (ACM)",
pages = "27--32",
booktitle = "NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022",
address = "United States",
note = "1st International Workshop on Native Network Intelligence ; Conference date: 09-12-2022",
}
RIS
TY - GEN
T1 - AI-based detection of DNS misuse for network security
AU - Chiscop, Irina
AU - Soro, Francesca
AU - Smith, Paul
PY - 2022/12/9
Y1 - 2022/12/9
N2 - Threat hunting and malware prediction are critical activities to ensure network and system security. These tasks are difficult due to increasing numbers of sophisticated malware families. Automatically detecting anomalous Domain Name System (DNS) queries in operational traffic facilitates the detection of new malware infections, significantly contributing to the work of security practitioners. In this paper, we present two AI-based Domain Generation Algorithm (DGA) detection and classification techniques - a feature-based one, leveraging classic Machine Learning algorithms and a featureless one, based on Deep Learning - specifically intended to aid in this task. Both techniques are designed to be integrated in operational environments, dealing with hundreds of thousands to millions of new malware samples per day. We report the implementation details, the classification performance, the advantages and shortcomings for both techniques, as well as experiences from the deployment of this system in an industrial environment. We show that both techniques reach more than the 90% of accuracy in the case of binary DGA detection, with a slight degradation in performance in the multi-class classification case, in which the results strongly depend on the malware type.
AB - Threat hunting and malware prediction are critical activities to ensure network and system security. These tasks are difficult due to increasing numbers of sophisticated malware families. Automatically detecting anomalous Domain Name System (DNS) queries in operational traffic facilitates the detection of new malware infections, significantly contributing to the work of security practitioners. In this paper, we present two AI-based Domain Generation Algorithm (DGA) detection and classification techniques - a feature-based one, leveraging classic Machine Learning algorithms and a featureless one, based on Deep Learning - specifically intended to aid in this task. Both techniques are designed to be integrated in operational environments, dealing with hundreds of thousands to millions of new malware samples per day. We report the implementation details, the classification performance, the advantages and shortcomings for both techniques, as well as experiences from the deployment of this system in an industrial environment. We show that both techniques reach more than the 90% of accuracy in the case of binary DGA detection, with a slight degradation in performance in the multi-class classification case, in which the results strongly depend on the malware type.
U2 - 10.1145/3565009.3569523
DO - 10.1145/3565009.3569523
M3 - Conference contribution/Paper
T3 - NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022
SP - 27
EP - 32
BT - NativeNI 2022 - Proceedings of the 1st International Workshop on Native Network Intelligence, Part of CoNEXT 2022
PB - Association for Computing Machinery (ACM)
CY - New York
T2 - 1st International Workshop on Native Network Intelligence
Y2 - 9 December 2022
ER -
