Joint Detection of Malicious Domains and Infected Clients
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F19%3A00339850" target="_blank" >RIV/68407700:21230/19:00339850 - isvavai.cz</a>
Result on the web
<a href="https://doi.org/10.1007/s10994-019-05789-z" target="_blank" >https://doi.org/10.1007/s10994-019-05789-z</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1007/s10994-019-05789-z" target="_blank" >10.1007/s10994-019-05789-z</a>
Alternative languages
Result language
angličtina
Original language name
Joint Detection of Malicious Domains and Infected Clients
Original language description
Detection of malware-infected computers and detection of malicious web domains based on their encrypted HTTPS traffic are challenging problems, because only addresses, timestamps, and data volumes are observable. The detection problems are coupled, because infected clients tend to interact with malicious domains. Traffic data can be collected at a large scale, and antivirus tools can be used to identify infected clients in retrospect. Domains, by contrast, have to be labeled individually after forensic analysis. We explore transfer learning based on sluice networks; this allows the detection models to bootstrap each other. In a large-scale experimental study, we find that the model outperforms known reference models and detects previously unknown malware, previously unknown malware families, and previously unknown malicious domains.
Czech name
—
Czech description
—
Classification
Type
J<sub>imp</sub> - Article in a specialist periodical, which is included in the Web of Science database
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/GA18-21409S" target="_blank" >GA18-21409S: Hierarchical models for detection and description of anomalies</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Others
Publication year
2019
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Name of the periodical
Machine Learning
ISSN
0885-6125
e-ISSN
1573-0565
Volume of the periodical
108
Issue of the periodical within the volume
8-9
Country of publishing house
NL - THE KINGDOM OF THE NETHERLANDS
Number of pages
16
Pages from-to
1353-1368
UT code for WoS article
000478619200008
EID of the result in the Scopus database
2-s2.0-85062148327