AutoRoC-DBSCAN: Automatic Tuning of DBSCAN to Detect Malicious DNS Tunnels - Archive ouverte HAL Access content directly
Conference Papers Year : 2023

AutoRoC-DBSCAN: Automatic Tuning of DBSCAN to Detect Malicious DNS Tunnels

Abstract

Domain Name System (DNS) is one of the core services of the Internet. Whereas it was created to associate domain names and IP addresses, modern attacks, such as Advanced Persistent Threats, use tunneling techniques over the DNS protocol to build covert channels in order to infiltrate the local network or exfiltrate data while bypassing security systems. Unsupervised machine learning techniques, and more specifically, Density-Based Spatial Clustering of Applications with Noise (DBSCAN), can achieve good results in detecting simple malicious DNS tunnels. However, DBSCAN requires manually tuning two hyperparameters, whose optimal values can be different depending on the dataset. In this article, we propose an improved algorithm called AutoRoC-DBSCAN that can automatically find the best hyperparameters, in order to automate the detection of malicious DNS tunnels in a completely new dataset.
No file

Dates and versions

hal-04251768 , version 1 (20-10-2023)

Identifiers

Cite

Thi Quynh Nguyen, Romain Laborde, Abdelmalek Benzekri, Arnaud Oglaza, Mehdi Mounsif. AutoRoC-DBSCAN: Automatic Tuning of DBSCAN to Detect Malicious DNS Tunnels. 3rd International Symposium on Emerging Information Security and Applications (EISA 2022), Oct 2022, Wuhan, China. pp.126-144, ⟨10.1007/978-3-031-23098-1_8⟩. ⟨hal-04251768⟩
25 View
0 Download

Altmetric

Share

Gmail Facebook X LinkedIn More