On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Classifier-Based Methods <s> The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way mapping between domain names and their numerical identifiers. Given its fundamental role, it is not surprising that a wide variety of malicious activities involve the domain name service in one way or another. For example, bots resolve DNS names to locate their command and control servers, and spam mails contain URLs that link to domains that resolve to scam servers. Thus, it seems beneficial to monitor the use of the DNS system for signs that indicate that a certain name is used as part of a malicious operation. In this paper, we introduce EXPOSURE, a system that employs large-scale, passive DNS analysis techniques to detect domains that are involved in malicious activity. We use 15 features that we extract from the DNS traffic that allow us to characterize different properties of DNS names and the ways that they are queried. Our experiments with a large, real-world data set consisting of 100 billion DNS requests, and a real-life deployment for two weeks in an ISP show that our approach is scalable and that we are able to automatically identify unknown malicious domains that are misused in a variety of malicious activity (such as for botnet command and control, spamming, and phishing). <s> BIB001 </s> On the Security of Machine Learning in Malware C&C Detection: A Survey <s> Classifier-Based Methods <s> In this paper we present PeerRush, a novel system for the identification of unwanted P2P traffic. Unlike most previous work, PeerRush goes beyond P2P traffic detection, and can accurately categorize the detected P2P traffic and attribute it to specific P2P applications, including malicious applications such as P2P botnets. PeerRush achieves these results without the need of deep packet inspection, and can accurately identify applications that use encrypted P2P traffic. ::: ::: We implemented a prototype version of PeerRush and performed an extensive evaluation of the system over a variety of P2P traffic datasets. Our results show that we can detect all the considered types of P2P traffic with up to 99.5% true positives and 0.1% false positives. Furthermore, PeerRush can attribute the P2P traffic to a specific P2P application with a misclassification rate of 0.68% or less. <s> BIB002
Like signature-based methods, classifier-based methods use past observations to assign labels to new samples. A classifier is trained using a dataset of labeled data with each point represented by a set of features. The labels for each data point in the dataset are known, making this an example of supervised learning. The training data can be collected from many sources. Again, malicious data can be collected from honeypots and sandboxes, or they could be collected from actual traffic that has been identified as malicious. Legitimate data is often collected from live network traffic that has any known maliciousness removed, or it can be taken from known public sources. For example, sets of legitimate domains can be found by looking at the Alexa rankings. 4.4.1. Communication Pattern Detection. BIB002 provide a two-step system for identifying hosts participating in malicious P2P behavior. First, a boosted decision tree classifier identifies hosts that exhibit any P2P behavior. Then, a two-step process identifies the P2P network to which the host belongs. A classifier is trained for each different P2P application (the actual classifier is interchangeable, although they test with the KNN, Gaussian, and Parzen classifiers), and then the host traffic is passed through all classifiers. If one classifier outputs a score above a threshold, the host is viewed as running that application. A random forest classifier is used to solve cases where two applications are matched. The first stage is able to identify P2P hosts with a TP rate of up to 90%, which can be boosted to 98.6% if the random forest classifier is used with a short time window. The effectiveness of the application classifiers varies. For example, the legitimate applications and Zeus botnet can be identified with a 90% TP rate and at most a 3% FP rate. The Storm and Waledac botnets achieve lower TP rates at 45% and 40%, respectively, but with lower FP rates. The total misclassification error is 0.68%. BIB001 ] is a system for applying large-scale, passive DNS traffic analysis to identify malicious domains (not limited to those related to C&C behavior but rather those involved in any malicious behavior). The system extracts 15 features (time based, DNS based, TTL based, and domain name based). A training set is built using sources of known benign and malicious domains (Alexa ranking, blacklists, etc.) . This is then used to train the J48 classifier (an implementation of C4.5 decision trees). The system is tested on 100 billion DNS queries, using 10-fold cross validation. The system achieves detection rates of up to 98.5%, with an FP rate of around 1%. The authors state that an adversary could possibly evade the system through the use of rate-limiting DNS queries from infected hosts or by using uniform TTL values, although it is argued that these are unlikely to occur because they will lead to a drop in the performance of the malware.