AutoRoC-DBSCAN: Automatic Tuning of DBSCAN to Detect Malicious DNS Tunnels - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

AutoRoC-DBSCAN: Automatic Tuning of DBSCAN to Detect Malicious DNS Tunnels

Résumé

Domain Name System (DNS) is one of the core services of the Internet. Whereas it was created to associate domain names and IP addresses, modern attacks, such as Advanced Persistent Threats, use tunneling techniques over the DNS protocol to build covert channels in order to infiltrate the local network or exfiltrate data while bypassing security systems. Unsupervised machine learning techniques, and more specifically, Density-Based Spatial Clustering of Applications with Noise (DBSCAN), can achieve good results in detecting simple malicious DNS tunnels. However, DBSCAN requires manually tuning two hyperparameters, whose optimal values can be different depending on the dataset. In this article, we propose an improved algorithm called AutoRoC-DBSCAN that can automatically find the best hyperparameters, in order to automate the detection of malicious DNS tunnels in a completely new dataset.
Fichier non déposé

Dates et versions

hal-04251768 , version 1 (20-10-2023)

Identifiants

Citer

Thi Quynh Nguyen, Romain Laborde, Abdelmalek Benzekri, Arnaud Oglaza, Mehdi Mounsif. AutoRoC-DBSCAN: Automatic Tuning of DBSCAN to Detect Malicious DNS Tunnels. 3rd International Symposium on Emerging Information Security and Applications (EISA 2022), Oct 2022, Wuhan, China. pp.126-144, ⟨10.1007/978-3-031-23098-1_8⟩. ⟨hal-04251768⟩
30 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More