PaperlayerView exact revision on arXiv

Source-linked AI summary

DeepDGA: Adversarially-Tuned Domain Generation and Detection

Hyrum S. Anderson, Jonathan Woodbridge, Bobby Filar

arXiv:1610.01969v1cs.CRcs.AI

TL;DR

The paper addresses the limited ability of DGA detectors trained on restricted datasets to recognize new variants. It uses a GAN to generate adversarial domain names and shows that these examples transfer across model architectures and can harden detection against unseen DGA families.

  • Problem

    DGA detectors trained on limited datasets can be blind to new variants, motivating automatically generated adversarial examples for training-set augmentation.

  • Method

    The paper trains a character-based GAN whose generator produces domains optimized to evade a deep-learning DGA detector, using autoencoder pre-training and specialized training strategies.

  • Results

    Adversarial domains bypassed the deep-learning detector, transferred to a random-forest model, and helped harden it against previously unseen DGA families.

  • Takeaways & Limitations

    GAN-crafted adversarial examples can augment training data to improve robustness across different DGA detection model architectures.

  • Takeaways & Limitations

    The hardening approach may adversely affect false-positive rate without care, while direct comparison with fast-gradient-sign hardening remains future work.

Abstract

from arXiv · show

Many malware families utilize domain generation algorithms (DGAs) to establish command and control (C&C) connections. While there are many methods to pseudorandomly generate domains, we focus in this paper on detecting (and generating) domains on a per-domain basis which provides a simple and flexible means to detect known DGA families. Recent machine learning approaches to DGA detection have been successful on fairly simplistic DGAs, many of which produce names of fixed length. However, models trained on limited datasets are somewhat blind to new DGA variants. In this paper, we leverage the concept of generative adversarial networks to construct a deep learning based DGA that is designed to intentionally bypass a deep learning based detector. In a series of adversarial rounds, the generator learns to generate domain names that are increasingly more difficult to detect. In turn, a detector model updates its parameters to compensate for the adversarially generated domains. We test the hypothesis of whether adversarially generated domains may be used to augment training sets in order to harden other machine learning models against yet-to-be-observed DGAs. We detail solutions to several challenges in training this character-based generative adversarial network (GAN). In particular, our deep learning architecture begins as a domain name auto-encoder (encoder + decoder) trained on domains in the Alexa one million. Then the encoder and decoder are reassembled competitively in a generative adversarial network (detector + generator), with novel neural architectures and training strategies to improve convergence.

I. INTRODUCTION

The paper proposes a GAN-based framework that generates domain names designed to evade DGA detectors and uses those adversarial examples to harden independent classifiers against unseen families.

  • I. INTRODUCTION: Machine-learning DGA detectors can contain vulnerabilities, motivating automatic discovery of adversarial examples for training-set augmentation.The paper frames adversarial examples as artificial samples that models misidentify and tests whether they can make models more robust.
  • I. INTRODUCTION: The framework begins with a domain-name autoencoder trained on Alexa domains, then reassembles its encoder and decoder as generator and detector components.The paper introduces neural architectures and training strategies to improve convergence.
  • I. INTRODUCTION: The proposed GAN generates domain names pseudo-randomly on a character-by-character basis to make them difficult for DGA classifiers to detect.Its generator is coupled with a detector so generation is explicitly optimized against classification.
  • I. INTRODUCTION: Adversarial domains optimized against the deep-learning detector also bypass a random-forest classifier using hand-crafted features.This cross-architecture transfer is presented as evidence that the examples are not specific to the model used to generate them.
  • I. INTRODUCTION: Augmenting the random-forest training set with adversarial examples improves detection of DGA malware families absent from training.The paper describes this as experimentally hardening the classifier against never-before-seen families.

II. BACKGROUND

The background contrasts traditional character- and dictionary-based DGAs with DeepDGA’s learned character-level generation, emphasizing how closely some conventional DGAs resemble benign domain distributions.

  • II. BACKGROUND: DGAs help malware establish C&C by generating large numbers of pseudo-random domains from a shared seed.This forces defenders to block many possible domains while malware needs only to connect to one.
  • II. BACKGROUND: Traditional DGAs range from uniformly random character generation to algorithms that mimic character or word distributions in real domains.Ramnit uses arithmetic operations from a random seed, whereas suppobox concatenates randomly selected English dictionary words.
  • II. BACKGROUND: The paper’s examples include character-level families with varied structures, including rigid domains from beebone and nearly pronounceable names from symmi.These examples illustrate the diversity of DGA construction strategies considered or discussed.
  • II. BACKGROUND: Cryptolocker and ramnit have nearly uniform unigram distributions, while suppobox resembles the Alexa top one million distribution.Suppobox achieves this resemblance by concatenating multiple randomly chosen English dictionary words.
  • II. BACKGROUND: DeepDGA uses a deep-learning character-based generator intended to mimic Alexa domain-character distributions more directly than simpler random-character DGAs.Its objective is to produce domains that are difficult for a DGA classifier to distinguish from real domains.

B. DGA detection algorithms

DGA detection methods use either clustered contextual statistics or individual-domain features; this paper adopts the latter setting without contextual information.

  • B. DGA detection algorithms: Prior DGA classifiers either exploit bulk domain statistics and contextual information or classify individual domains without additional context.The paper places its work in the individual-domain classification category.
  • B. DGA detection algorithms: Clustering-based approaches group unknown domains using shared second-level domains, IP addresses, and statistical characteristics before classification.Features include length, entropy, and character-frequency distributions, and some systems then use family-specific HMMs.
  • B. DGA detection algorithms: Another individual-domain method uses meaningful-character ratios and n-gram normality, classifying domains by Mahalanobis distance from a benign Alexa set.Larger distance indicates a domain more likely to be DGA-generated in that filtering approach.
  • B. DGA detection algorithms: The paper evaluates a random-forest classifier using features drawn from prior work while omitting full clustering systems and contextual inputs.The experimental setting is per-domain classification with no contextual information.

C. Adversarial Examples and Generative Adversarial Networks

The paper frames adversarial examples as a way to expose machine-learning vulnerabilities and uses GANs to generate artificial domains that harden a DGA detector. RNNs and LSTMs provide sequence modeling with mechanisms for retaining information over long domain-name sequences.

  • Adversarial examples: Adversarial examples expose vulnerabilities in machine-learning models, motivating automated discovery and training-set augmentation.The paper connects this motivation to a GAN-based framework for a natural-language DGA detector.
  • Generative adversarial networks: GANs pair a generator and detector that compete adversarially, with the generator producing artificial domains and the detector distinguishing them from true domain data.The generator and detector are trained through successive adversarial rounds.
  • Recurrent neural networks: RNNs capture temporal relationships by mapping each input to an output using both the current input and previous activations.This recurrent state provides contextual information for sequence modeling.
  • Recurrent neural networks: Traditional RNNs struggle with long-term dependencies because recurrent operations can cause gradients to vanish or, less commonly, explode.This limitation motivates using LSTM cells.
  • Long Short-Term Memory: LSTM cells use programmable gates to read, write, reset, retain, or overwrite state across time steps.Input and forget gates regulate state updates and recurrent retention, while output gates regulate emissions.
  • Long Short-Term Memory: Multiplicative LSTM gates support storing and accessing state over long sequences, mitigating vanishing gradients while capturing important domain-name token combinations.The intended state space models combinations of tokens relevant to domain names.

E. Highway Networks

Highway networks extend gated-memory ideas to feedforward networks by allowing layers to adaptively carry input dimensions directly to the output. Their output combines raw and transformed inputs through learned gates.

  • Highway network motivation: Highway networks extend gated memory networks such as LSTMs to feedforward networks.They enable deep-network training by adaptively carrying some input dimensions directly to the output.
  • Highway layer operation: A highway layer forms an elementwise convex combination of the raw input and transformed input g(Wx + b).The combination is controlled by a vector gate t whose entries lie between 0 and 1.
  • Highway layer operation: Highway layers learn both transformation parameters and gating parameters during training.The learned gate determines how much of the raw or transformed input contributes to each output dimension.

III. METHOD

The method first learns domain representations with a character-level autoencoder, then repurposes its encoder and decoder as discriminator and generator in an adversarial network. Frozen pretrained weights and specialized training components let the generator map random inputs into domain embeddings while competing with a detector.

  • Autoencoder: The architecture first trains a character-level autoencoder whose encoder produces domain embeddings and whose decoder reconstructs domain names.The encoder uses character embeddings, convolutional filters, max pooling, a highway network, and an LSTM; the decoder reverses this process and samples characters from multinomial outputs.
  • GAN repurposing: The pretrained autoencoder is repurposed as a GAN: the decoder becomes the generator and the encoder becomes a discriminative model.A dense layer maps random input to a domain embedding, while logistic regression is appended to the encoder embedding.
  • Generator constraints: A predefined box layer restricts generator outputs to an embedding-space region learned from training data, with an alternative principal-axis version aligned to the data’s principal dimensions.The box parameterization maps sigmoid outputs between minimum and maximum corners; the principal-axis variant transforms back using the right singular-vector matrix.
  • Adversarial training: During adversarial training, the original autoencoder weights remain frozen while the generator layer and logistic regression layer are trained competitively.The discriminator separates valid domains from generated names, and the generator learns to confound it.
  • Adversarial training: Training the discriminator on a sampled history of current and previous generated domains helps the generator avoid inadequate coverage and repeated failure modes.This differs from training only on the most recently generated samples.

IV. EXPERIMENTAL SETUP

The experiments train the autoencoder and GAN on Alexa top 1M domains, generate domains from random seeds, and evaluate detectability with an independent random-forest classifier using handcrafted features.

  • Training data: The autoencoder is trained on Alexa top 1M domains, while the GAN distinguishes Alexa top 1M domains from pseudorandom domains generated by the autoencoder encoder.The implementation uses Keras with Adam and batch size 128; only a few adversarial rounds were needed with default learning rates.
  • Domain generation: The generator accepts 20 uniformly distributed random numbers as a seed and samples the output with a multinomial procedure using the common seed.This provides pseudorandom input for producing fake domain names.
  • Evaluation: Detectability is measured with an independent random-forest DGA classifier using manually crafted domain-name features.The feature set includes length, character entropy, vowel-to-consonant ratio, Alexa n-gram cooccurrence counts, n-gram normality, and meaningful-character ratio.
  • Evaluation: The n-gram normality score uses n = 3, n = 4, and n = 5 as distinct features because larger n-grams performed better in preliminary experiments.This differs from the n-gram sizes used in the cited prior work.

V. RESULTS

The reported setup uses substantial autoencoder pretraining followed by repeated adversarial rounds that generate samples for detector training and evaluation.

  • Training procedure: The autoencoder is pretrained for 300 epochs using 256K randomly sampled Alexa domains per epoch and batch size 128.Pretraining takes roughly 14 hours on a single NVIDIA Titan X GPU.
  • Adversarial rounds: Each adversarial round generates 12,800 adversarial samples against the detector and requires roughly 7 minutes on the GPU.These generated samples support the subsequent adversarial training stages.

A. Autoencoder results

The autoencoder produces stochastic character-level reconstructions that need not exactly reproduce inputs but remain adequate for generating domains from a similar distribution. Separately, adversarial rounds progressively reduce random-forest detectability through three rounds.

  • Autoencoder output: The autoencoder outputs a multinomial distribution over possible characters, from which sampled domains are generated.Table II presents examples sampled with the TLD removed.
  • Autoencoder output: The autoencoder does not reconstruct inputs perfectly because character sampling is stochastic and model capacity is insufficient for all character combinations.The paper considers these imperfect reconstructions adequate because the goal is to sample from a similar distribution rather than reproduce Alexa domains exactly.
  • Adversarial detectability: The random-forest classifier’s performance degrades as adversarial rounds increase, with an apparent asymptote after three rounds.Figure 3 reports ROC curves averaged over 10-fold cross-validation for DeepDGA domains versus Alexa top 10K benign domains.

B. GAN results

Adversarial rounds make DeepDGA domains increasingly difficult for classifiers to detect, while bringing their character distribution closer to Alexa domains. Adversarial examples also improve detection of previously unseen DGA families when added to training.

  • Adversarial rounds: After three adversarial rounds, the random forest classifier’s performance degrades with an apparent asymptote, motivating three rounds for subsequent experiments.The paper attributes decreasing utility after three rounds to the GAN’s reduced ability to further affect the detector.
  • Domain characteristics: After three rounds, DeepDGA’s unigram distribution approaches that of the Alexa top 1M, indicating more confusing generated domains.Figure 4 compares distributions before adversarial rounds, after three rounds, and against Alexa top 1M domains.
  • Detection against individual DGAs: DeepDGA’s false negative rate is roughly 1 in 14, versus roughly 1 in 106 for pykspa, a decrease of over 7×.These values come from random forest classifiers trained separately to detect each character-based DGA against Alexa top 10K domains.
  • Generalized detection: On a general detector trained across available samples, less than 50% of DeepDGA samples are detected, compared with 98% for simda and kraken_v2.The comparison uses 10-fold cross-validation with 20% holdout sets and equal numbers of Alexa and DGA samples.
  • Hardening unseen-family detection: Augmenting training with DeepDGA adversarial examples generally improves detection of unseen DGA families, especially those with low baseline TPRs.At a fixed 1% FPR, all families except dircrypt and lockyv2 maintain or increase effective TPR after hardening.

VI. DISCUSSION

DeepDGA adversarial examples transfer from the targeted deep learning detector to a random forest detector. Adding them to training hardens the random forest against DGA families absent from training, although GAN training requires specialized strategies to avoid failure modes.

  • Discussion: DeepDGA examples adversarial to the deep learning detector are also adversarial to a random forest using human-engineered features.This demonstrates transferability across substantially different detector architectures.
  • Discussion: GAN training requires history regularization, specialized box layers, and autoencoder pre-training to prevent common failure modes.The paper presents these techniques as strategies that simplify generator learning and improve training stability.
  • Discussion: Training with DeepDGA examples generally increases random forest TPR at a fixed FPR for DGA families not observed during training.The hardened classifier is evaluated using held-out DGA families.
Loading 1610.01969v1…