An Analysis of Convolutional Neural Networks for detecting DGA

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F18%3A00333206" target="_blank" >RIV/68407700:21230/18:00333206 - isvavai.cz</a>

Výsledek na webu

<a href="http://sedici.unlp.edu.ar/bitstream/handle/10915/73629/Documento_completo.pdf-PDFA.pdf?sequence=1&isAllowed=y" target="_blank" >http://sedici.unlp.edu.ar/bitstream/handle/10915/73629/Documento_completo.pdf-PDFA.pdf?sequence=1&isAllowed=y</a>

DOI - Digital Object Identifier

—

Jazyk výsledku

angličtina

Název v původním jazyce

An Analysis of Convolutional Neural Networks for detecting DGA

Popis výsledku v původním jazyce

A Domain Generation Algorithm (DGA) is an algorithm togenerate domain names in a deterministic but seemly random way. Mal-ware use DGAs to generate the next domain to access the CommandControl (C&C) communication channel. Given the simplicity and veloc-ity associated to the domain generation process, machine learning detec-tion methods emerged as suitable detection solution. However, since theperiodical retraining becomes mandatory, a fast and accurate detectionmethod is needed. Convolutional neural network (CNN) are well knownfor performing real-time detection in fields like image and video recogni-tion. Therefore, they seem suitable for DGA detection. The present workis a preliminary analysis of the detection performance of CNN for DGAdetection. A CNN with a minimal architecture complexity was evaluatedon a dataset with 51 DGA malware families as well as normal domains.Despite its simple architecture, the resulting CNN model correctly de-tected more than 97% of total DGA domains with a false positive rateclose to 0.7%.

Název v anglickém jazyce

An Analysis of Convolutional Neural Networks for detecting DGA

Popis výsledku anglicky

A Domain Generation Algorithm (DGA) is an algorithm togenerate domain names in a deterministic but seemly random way. Mal-ware use DGAs to generate the next domain to access the CommandControl (C&C) communication channel. Given the simplicity and veloc-ity associated to the domain generation process, machine learning detec-tion methods emerged as suitable detection solution. However, since theperiodical retraining becomes mandatory, a fast and accurate detectionmethod is needed. Convolutional neural network (CNN) are well knownfor performing real-time detection in fields like image and video recogni-tion. Therefore, they seem suitable for DGA detection. The present workis a preliminary analysis of the detection performance of CNN for DGAdetection. A CNN with a minimal architecture complexity was evaluatedon a dataset with 51 DGA malware families as well as normal domains.Despite its simple architecture, the resulting CNN model correctly de-tected more than 97% of total DGA domains with a false positive rateclose to 0.7%.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/TH02010990" target="_blank" >TH02010990: Ludus: Kolaborativní obrana proti internetovým útokům pomocí stojového učení a teorie her</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2018

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Computer Science - CACIC 2018

ISBN

978-950-658-472-6

ISSN

—

e-ISSN

—

Počet stran výsledku

10

Strana od-do

1060-1069

Název nakladatele

Springer

Místo vydání

Cham

Místo konání akce

Tandil

Datum konání akce

8. 10. 2018

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—