Unsupervised malicious domain detection with less labeling effort

自编码 计算机科学 恶意软件 领域(数学分析) 人工智能 机器学习 集合(抽象数据类型) 数据挖掘 对策 特征(语言学) 极限(数学) 模式识别(心理学) 深度学习 计算机安全 工程类 程序设计语言 航空航天工程 哲学 数学分析 语言学 数学
作者
Huy Kang Kim,Hyun Min Song,Jeong Do Yoo,Suyoun Hong,Byungmo Cho,Kwangsoo Kim,Huy Kang Kim
出处
期刊:Computers & Security [Elsevier]
卷期号:116: 102662-102662 被引量:5
标识
DOI:10.1016/j.cose.2022.102662
摘要

Since malware creates severe damage to the system, past studies leveraged various algorithms to detect malicious domains generated from Domain Generation Algorithms (DGAs). Although they achieved a promising performance, security practitioners had to acquire a large amount of fine-labeled dataset with a particular effort. Throughout the research, we propose a series of analysis to build a novel malicious domain detection method with the autoencoder in an unsupervised approach to overcome this limit. The contributions of our study are as follows. First, we proposed significant feature extraction methods that focused on the domain’s linguistic patterns and validated the proposed set of features effectively discriminate benign domains and malicious domains. Second, we established a malicious domain detection method with the autoencoder only with benign domains provided during the model training. Thus, we let a security practitioner build a malicious domain detection model with less labeling effort. Third, the proposed malicious domain detection model achieved a precise detection performance of 99% accuracy and F1 score. Lastly, our model maintains the aforementioned detection performance, although it is trained with a small training set; thus, the model reduces training dataset accumulation effort. Although our detection model cannot identify malicious domains’ origins, particular types of DGA, we evaluate security practitioners can easily implement a countermeasure against DGAs with less effort. In pursuit of precise malicious domain detection, we expect our study can be a concrete baseline for future works.
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
大幅提高文件上传限制,最高150M (2024-4-1)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
所所应助autism采纳,获得30
1秒前
1秒前
tododoto完成签到,获得积分10
2秒前
汉堡包应助marymarychou采纳,获得10
3秒前
斯文败类应助老实怀蝶采纳,获得10
3秒前
kkdkg发布了新的文献求助10
3秒前
青椒肉丝完成签到,获得积分10
3秒前
4秒前
动听秋蝶应助可乐采纳,获得10
4秒前
胡杨柳完成签到,获得积分10
5秒前
zz发布了新的文献求助10
5秒前
二胡儿发布了新的文献求助10
6秒前
两院候选人应助sss采纳,获得10
6秒前
JamesPei应助jillian采纳,获得10
7秒前
7秒前
7秒前
辛夷完成签到,获得积分10
7秒前
7秒前
zhangfan发布了新的文献求助10
8秒前
8秒前
搜集达人应助买糖顶针采纳,获得10
9秒前
9秒前
9秒前
cocolu应助舒服的酒窝采纳,获得10
10秒前
10秒前
cbq完成签到 ,获得积分10
11秒前
11秒前
12秒前
乐乐乐乐乐乐应助杨娟娟采纳,获得10
12秒前
辛夷发布了新的文献求助30
12秒前
Aixia完成签到 ,获得积分10
12秒前
十四季白完成签到,获得积分10
12秒前
holic发布了新的文献求助10
13秒前
13秒前
13秒前
2017发布了新的文献求助10
13秒前
阿海发布了新的文献求助10
14秒前
15秒前
15秒前
15秒前
高分求助中
Licensing Deals in Pharmaceuticals 2019-2024 3000
Cognitive Paradigms in Knowledge Organisation 2000
Effect of reactor temperature on FCC yield 2000
Near Infrared Spectra of Origin-defined and Real-world Textiles (NIR-SORT): A spectroscopic and materials characterization dataset for known provenance and post-consumer fabrics 610
Introduction to Spectroscopic Ellipsometry of Thin Film Materials Instrumentation, Data Analysis, and Applications 600
Promoting women's entrepreneurship in developing countries: the case of the world's largest women-owned community-based enterprise 500
Shining Light on the Dark Side of Personality 400
热门求助领域 (近24小时)
化学 医学 生物 材料科学 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 基因 遗传学 催化作用 物理化学 免疫学 量子力学 细胞生物学
热门帖子
关注 科研通微信公众号,转发送积分 3309005
求助须知:如何正确求助?哪些是违规求助? 2942374
关于积分的说明 8508619
捐赠科研通 2617432
什么是DOI,文献DOI怎么找? 1430073
科研通“疑难数据库(出版商)”最低求助积分说明 664018
邀请新用户注册赠送积分活动 649234