Hardening DGA classifiers utilizing IVAP

C Grumer, J Peck, F Olumofin… - … Conference on Big …, 2019 - ieeexplore.ieee.org
C Grumer, J Peck, F Olumofin, A Nascimento, M De Cock
2019 IEEE International Conference on Big Data (Big Data), 2019ieeexplore.ieee.org
Domain Generation Algorithms (DGAs) are used by malware to generate a deterministic set
of domains, usually by utilizing a pseudo-random seed. A malicious botmaster can establish
connections between their command-and-control center (C&C) and any malware-infected
machines by registering domains that will be DGA-generated given a specific seed,
rendering traditional domain blacklisting ineffective. Given the nature of this threat, the real-
time detection of DGA domains based on incoming DNS traffic is highly important. The use …
Domain Generation Algorithms (DGAs) are used by malware to generate a deterministic set of domains, usually by utilizing a pseudo-random seed. A malicious botmaster can establish connections between their command-and-control center (C&C) and any malware-infected machines by registering domains that will be DGA-generated given a specific seed, rendering traditional domain blacklisting ineffective. Given the nature of this threat, the real-time detection of DGA domains based on incoming DNS traffic is highly important. The use of neural network machine learning (ML) models for this task has been well-studied, but there is still substantial room for improvement. In this paper, we propose to use Inductive Venn-Abers predictors (IVAPs) to calibrate the output of existing ML models for DGA classification. The IVAP is a computationally efficient procedure which consistently improves the predictive accuracy of classifiers at the expense of not offering predictions for a small subset of inputs and consuming an additional amount of training data.
ieeexplore.ieee.org
Showing the best result for this search. See all results