Detecting DNS Threats: A Deep Learning Model to Rule Them All
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F19%3A00348185" target="_blank" >RIV/68407700:21230/19:00348185 - isvavai.cz</a>
Result on the web
<a href="http://170.210.201.137/pdfs/asai/ASAI-10.pdf" target="_blank" >http://170.210.201.137/pdfs/asai/ASAI-10.pdf</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.13140/RG.2.2.14296.03849" target="_blank" >10.13140/RG.2.2.14296.03849</a>
Alternative languages
Result language
angličtina
Original language name
Detecting DNS Threats: A Deep Learning Model to Rule Them All
Original language description
Domain Name Service is a central part of Internet regular operation. Such importance has made it a common target of different malicious behaviors such as the application of Domain Generation Algorithms (DGA) for command and control a group of infected computers or Tunneling techniques for bypassing system administrator restrictions. A common detection approach is based on Training different models detecting DGA and Tunneling capable of performing a lexicographic discrimination of the domain names. However, since both DGA and Tunneling showed domain names with observable lexicographical differences with normal domains, it was reasonable to apply the same detection approach to both threats. In the present work, we propose a multi class convolutional network architecture (MC-CNN) capable of detecting both DNS threats. The resulting MC-CNN is able to detect correctly 99% of normal domains ,97% of DGAs and 92% of Tunneling, with a False Positive Rate of 2.8%, 0.7% and 0.0015% respectively.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/TH02010990" target="_blank" >TH02010990: Ludus: Machine Learning and Game Theory to Collaboratively Defend Against Internet Threats</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Others
Publication year
2019
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
ASAI
ISBN
—
ISSN
2451-7585
e-ISSN
—
Number of pages
12
Pages from-to
90-101
Publisher name
ARGENTINE SYMPOSIUM ON ARTIFICIAL INTELLIGENCE
Place of publication
—
Event location
Argentina University
Event date
Jun 10, 2019
Type of event by nationality
EUR - Evropská akce
UT code for WoS article
—