DGA detection using machine learning methods

Yksi yleisimmistä kyberhyökkäysistä on käyttää ryhmä yksityisiä tietokoneita (private computers), joita käytetään esimerkiksi salaisien tietojen levittämiseen. Näitä koneryhmiä kutsutaan botnet. Botnetit pysyvät havaitsemattomana käyttämällä Domain Name Generation (DGA) menetelmää, joka luo ajoit...

Full description

Bibliographic Details
Main Author: Baruch, Moran
Other Authors: Informaatioteknologian tiedekunta, Faculty of Information Technology, Tietotekniikan laitos, Department of Mathematical Information Technology, University of Jyväskylä, Jyväskylän yliopisto
Format: Master's thesis
Language:eng
Published: 2016
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/52755
_version_ 1826225767580696576
author Baruch, Moran
author2 Informaatioteknologian tiedekunta Faculty of Information Technology Tietotekniikan laitos Department of Mathematical Information Technology University of Jyväskylä Jyväskylän yliopisto
author_facet Baruch, Moran Informaatioteknologian tiedekunta Faculty of Information Technology Tietotekniikan laitos Department of Mathematical Information Technology University of Jyväskylä Jyväskylän yliopisto Baruch, Moran Informaatioteknologian tiedekunta Faculty of Information Technology Tietotekniikan laitos Department of Mathematical Information Technology University of Jyväskylä Jyväskylän yliopisto
author_sort Baruch, Moran
datasource_str_mv jyx
description Yksi yleisimmistä kyberhyökkäysistä on käyttää ryhmä yksityisiä tietokoneita (private computers), joita käytetään esimerkiksi salaisien tietojen levittämiseen. Näitä koneryhmiä kutsutaan botnet. Botnetit pysyvät havaitsemattomana käyttämällä Domain Name Generation (DGA) menetelmää, joka luo ajoittain ja ratkaisee suurina lukumäärinä erillaisia pseudosatunnaisia verkkotunnuksia, kunnes jokin näistä pseudosatunnaisista verkkotunnuksista DNS palvelin hyväksyy. Tämän tutkielman tarkoitus on kehitellä ei- ohjattuja koneoppimismenetelmiä ja vertailla näiden tarkkuutta ohjattuihin koneoppimismenetelmiin DGA hyökkäyksien havaitsemiseen. Lisäksi, tutkielmassa esitellään Random One Class Support Vector Machine (ROC-SVM) menetelmä, joka havaitsee tarkemmin DGA hyökkäyksiä verrattuna ohjatuihin koneoppimismenetelmiin. botnet is a network of private computers infected with malicious software and controlled as a group without the knowledge of the owners. Botnets are used by cyber criminals for various malicious activities such as stealing sensitive data, sending spam, launching Distributed Denial of Service (DDoS) attacks, etc. A Command and Control (C&C) server sends commands to the compromised hosts for executing those malicious activities. In order to avoid detection, recent botnets such as Conficker, Zeus and Cryptolocker apply a technique called Domain Fluxing or Domain Name Generation Algorithms (DGA), where the infected bot is periodically generating and trying to resolve a large number of pseudo- random domain names until one of them is resolved by the DNS server. In this thesis, we survey different machine learning methods for detecting such DGAs by analyzing only the alphanumeric characteristics of the domain names in the network. We propose unsupervised models and evaluate their performance while comparing them with existing supervised models used in previous researches in this field. In addition, we propose a novel approach for unsupervised one-class SVM model for anomaly detection, which called Random One Class SVM (ROC-SVM). Our proposed unsupervised methods achieve better results than the compared supervised techniques, while detecting zero-day DGAs. If the run-time is of main concern, our novel approach for unsupervised one-class SVM is the best model among the others.
first_indexed 2023-03-22T09:59:24Z
format Pro gradu
free_online_boolean 1
fullrecord [{"key": "dc.contributor.author", "value": "Baruch, Moran", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2017-01-18T09:41:36Z", "language": null, "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2017-01-18T09:41:36Z", "language": null, "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2016", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.other", "value": "oai:jykdok.linneanet.fi:1659122", "language": null, "element": "identifier", "qualifier": "other", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/52755", "language": null, "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Yksi yleisimmist\u00e4 kyberhy\u00f6kk\u00e4ysist\u00e4 on k\u00e4ytt\u00e4\u00e4 ryhm\u00e4 yksityisi\u00e4 tietokoneita (private \ncomputers), joita k\u00e4ytet\u00e4\u00e4n esimerkiksi salaisien tietojen levitt\u00e4miseen. N\u00e4it\u00e4 koneryhmi\u00e4 \nkutsutaan botnet. Botnetit pysyv\u00e4t havaitsemattomana k\u00e4ytt\u00e4m\u00e4ll\u00e4 Domain Name \nGeneration (DGA) menetelm\u00e4\u00e4, joka luo ajoittain ja ratkaisee suurina lukum\u00e4\u00e4rin\u00e4 erillaisia \npseudosatunnaisia verkkotunnuksia, kunnes jokin n\u00e4ist\u00e4 pseudosatunnaisista \nverkkotunnuksista DNS palvelin hyv\u00e4ksyy. T\u00e4m\u00e4n tutkielman tarkoitus on kehitell\u00e4 ei-\nohjattuja koneoppimismenetelmi\u00e4 ja vertailla n\u00e4iden tarkkuutta ohjattuihin \nkoneoppimismenetelmiin DGA hy\u00f6kk\u00e4yksien havaitsemiseen. Lis\u00e4ksi, tutkielmassa \nesitell\u00e4\u00e4n Random One Class Support Vector Machine (ROC-SVM) menetelm\u00e4, joka \nhavaitsee tarkemmin DGA hy\u00f6kk\u00e4yksi\u00e4 verrattuna ohjatuihin koneoppimismenetelmiin.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "botnet is a network of private computers infected with malicious software and controlled \nas a group without the knowledge of the owners. Botnets are used by cyber criminals for \nvarious malicious activities such as stealing sensitive data, sending spam, launching \nDistributed Denial of Service (DDoS) attacks, etc. A Command and Control (C&C) server \nsends commands to the compromised hosts for executing those malicious activities. In order \nto avoid detection, recent botnets such as Conficker, Zeus and Cryptolocker apply a \ntechnique called Domain Fluxing or Domain Name Generation Algorithms (DGA), where \nthe infected bot is periodically generating and trying to resolve a large number of pseudo-\nrandom domain names until one of them is resolved by the DNS server. In this thesis, we \nsurvey different machine learning methods for detecting such DGAs by analyzing only the \nalphanumeric characteristics of the domain names in the network. We propose unsupervised \nmodels and evaluate their performance while comparing them with existing supervised \nmodels used in previous researches in this field. In addition, we propose a novel approach \nfor unsupervised one-class SVM model for anomaly detection, which called Random One \nClass SVM (ROC-SVM). Our proposed unsupervised methods achieve better results than \nthe compared supervised techniques, while detecting zero-day DGAs. If the run-time is of \nmain concern, our novel approach for unsupervised one-class SVM is the best model among \nthe others.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted using Plone Publishing form by Miia Hakanen (mihakane) on 2017-01-18 09:41:35.229147. Form: Admin-lomake opinn\u00e4ytteiden julkaisuun (https://kirjasto.jyu.fi/julkaisut/julkaisulomakkeet/admin-lomake-opinnaytteet). JyX data: [jyx_publishing-allowed (fi) =True]", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2017-01-18T09:41:36Z\nNo. of bitstreams: 2\nURN:NBN:fi:jyu-201701181180.pdf: 1925969 bytes, checksum: 634e2344fa7bb73aa1345d3dbeb9080b (MD5)\nlicense.html: 107 bytes, checksum: a7d86e598caa500b1b433bbb9dc8ef1c (MD5)", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2017-01-18T09:41:36Z (GMT). No. of bitstreams: 2\nURN:NBN:fi:jyu-201701181180.pdf: 1925969 bytes, checksum: 634e2344fa7bb73aa1345d3dbeb9080b (MD5)\nlicense.html: 107 bytes, checksum: a7d86e598caa500b1b433bbb9dc8ef1c (MD5)\n Previous issue date: 2016", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "1 verkkoaineisto (54 sivua)", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "eng", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "rakenteeton data", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "DGA-algoritmi", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "botnet", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "DGA detection using machine learning methods", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-201701181180", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Tietotekniikan laitos", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Department of Mathematical Information Technology", "language": "en", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Tietotekniikka", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Mathematical Information Technology", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.date.updated", "value": "2017-01-18T09:41:36Z", "language": null, "element": "date", "qualifier": "updated", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": null, "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": "fi", "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "602", "language": null, "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "koneoppiminen", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tietoturva", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}, {"key": "dc.type.okm", "value": "G2", "language": null, "element": "type", "qualifier": "okm", "schema": "dc"}]
id jyx.123456789_52755
language eng
last_indexed 2025-02-18T10:55:31Z
main_date 2016-01-01T00:00:00Z
main_date_str 2016
online_boolean 1
online_urls_str_mv {"url":"https:\/\/jyx.jyu.fi\/bitstreams\/92f8a7e8-6897-4ff1-8330-006d068475a3\/download","text":"URN:NBN:fi:jyu-201701181180.pdf","source":"jyx","mediaType":"application\/pdf"}
publishDate 2016
record_format qdc
source_str_mv jyx
spellingShingle Baruch, Moran DGA detection using machine learning methods rakenteeton data DGA-algoritmi botnet Tietotekniikka Mathematical Information Technology 602 koneoppiminen tietoturva
title DGA detection using machine learning methods
title_full DGA detection using machine learning methods
title_fullStr DGA detection using machine learning methods DGA detection using machine learning methods
title_full_unstemmed DGA detection using machine learning methods DGA detection using machine learning methods
title_short DGA detection using machine learning methods
title_sort dga detection using machine learning methods
title_txtP DGA detection using machine learning methods
topic rakenteeton data DGA-algoritmi botnet Tietotekniikka Mathematical Information Technology 602 koneoppiminen tietoturva
topic_facet 602 DGA-algoritmi Mathematical Information Technology Tietotekniikka botnet koneoppiminen rakenteeton data tietoturva
url https://jyx.jyu.fi/handle/123456789/52755 http://www.urn.fi/URN:NBN:fi:jyu-201701181180
work_keys_str_mv AT baruchmoran dgadetectionusingmachinelearningmethods