...
【24h】

Stealthy Domain Generation Algorithms

机译:隐身域生成算法

获取原文
获取原文并翻译 | 示例
           

摘要

Botnets are groups of compromised computers that botmasters (botherders) use to launch attacks over the Internet. To avoid detection, botnets use DNS fast flux to change the mapping between IP addresses and domain names periodically. Domain generation algorithms (DGAs) are employed to generate a large number of domain names. Detection techniques have been proposed to identify malicious domain names generated by DGAs. Three metrics, Kullback–Leibler (KL) distance, Edit distance (ED), and Jaccard index (JI), are used to detect botnet domains with up to 100% detection rate and 2.5% false-positive rate. In this paper, we propose two DGAs that use hidden Markov models (HMMs) and probabilistic context-free grammars (PCFGs), respectively. Experiment results show that DGA detection metrics (KL, JI, and ED) and detection systems (BotDigger and Pleiades) have difficulty detecting domain names generated using the proposed approaches. Game theory is used to optimize strategies for both botmasters and security personnel. Results show that, to optimize DGA detection, security personnel should use the ED detection technique with probability 0.78 and JI detection with probability 0.22, and botmasters should choose the HMM-based DGA with probability 0.67 and PCFG-based DGA with probability 0.33.
机译:僵尸网络是一群受感染的计算机,僵尸网络管理员(僵尸网络)用来通过Internet发起攻击。为了避免检测,僵尸网络使用DNS快速通量来定期更改IP地址和域名之间的映射。域生成算法(DGA)用于生成大量域名。已经提出了检测技术来识别由DGA生成的恶意域名。 Kullback-Leibler(KL)距离,编辑距离(ED)和Jaccard索引(JI)这三个指标用于检测僵尸网络域,检测率高达100%,假阳性率高达2.5%。在本文中,我们提出了两种分别使用隐马尔可夫模型(HMM)和概率上下文无关文法(PCFG)的DGA。实验结果表明,DGA检测指标(KL,JI和ED)和检测系统(BotDigger和Pleiades)难以检测使用该方法生成的域名。博弈论可用于针对Botmaster和安全人员优化策略。结果表明,为了优化DGA检测,安全人员应使用概率为0.78的ED检测技术和概率为0.22的JI检测,僵尸程序管理员应选择概率为0.67的基于HMM的DGA和概率为0.33的基于PCFG的DGA。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱:kefu@zhangqiaokeyan.com

京公网安备:11010802029741号 ICP备案号:京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有
  • 客服微信

  • 服务号