Domain Generation Algorithm Machine Learning

Attackers usually use a command and control c2 server to manipulate the communication.

Domain generation algorithm machine learning. The dns queries are passed as input to the system followed by the processes. Xiong and tommy chin and chengbin hu journal ieee access year 2019 volume 7 pages 32765 32782. In this article we cover a dynamic tactic used by cybercriminals.

A machine learning framework built for the detection of dga based domains has three important steps. In contrast dgas use algorithms to periodically generate a large number of domain names which function as rendezvous points for malware command and control servers mitre att ck t1568 002. The process components includes.

A machine learning framework for domain generation algorithm based malware detection article li2019aml title a machine learning framework for domain generation algorithm based malware detection author y. This post provides resources for getting started with research on domain generation algorithm dga domain detection. A machine learning framework for domain generation algorithm based malware detection abstract.

In order to perform an attack threat actors often employ a domain generation algorithm dga which can allow malware to communicate with c2 by generating a variety of network locations. Dga domains are commonly used by malware as a mechanism to maintain a command and control c2 and make it more difficult for defenders to block. Prior to dga domains most malware used a small hardcoded list of ips or domains.

Domain generation algorithms dgas allow attackers to manage infection spreading websites and command and control c c deployments by altering domain names on a timely basis. 3 2 machine learning framework. We showed how the calico enterprise dga machine learning algorithm can detect any present or future apts using dga to connect back to the c2 servers while minimizing false positives.

In addition the dga domain list provided by the algorithm is a valuable asset for any security team enabling them to efficiently mitigate threats while reducing dwell time and associated risk. Domain generation algorithms dgas and some unique methods that leverage artificial intelligence machine learning ai ml to counter these threats and discuss their false detections.