Time series deinterleaving of DNS traffic

Amir Asiaee T; Hardik Goel; Shalini Ghosh; Vinod Yegneswaran; Arindam Banerjee

doi:10.1109/SPW.2018.00024

Time series deinterleaving of DNS traffic

Amir Asiaee T, Hardik Goel, Shalini Ghosh, Vinod Yegneswaran, Arindam Banerjee

Computer Science and Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Stream deinterleaving is an important problem with various applications in the cybersecurity domain. In this paper, we consider the specific problem of deinterleaving DNS data streams using machine-learning techniques, with the objective of automating the extraction of malware domain sequences. We first develop a generative model for user request generation and DNS stream interleaving. Based on these we evaluate various inference strategies for deinterleaving including augmented HMMs and LSTMs on synthetic datasets. Our results demonstrate that state-of-the-art LSTMs outperform more traditional augmented HMMs in this application domain.

Original language	English (US)
Title of host publication	Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	103-108
Number of pages	6
ISBN (Print)	9780769563497
DOIs	https://doi.org/10.1109/SPW.2018.00024
State	Published - Aug 2 2018
Event	2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018 - San Francisco, United States Duration: May 24 2018 → …

Publication series

Name	Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018

Other

Other	2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018
Country/Territory	United States
City	San Francisco
Period	5/24/18 → …

Bibliographical note

Funding Information:
The work was supported in part by NSF grants CNS- 1314560, IIS-1447566, IIS-1447574, IIS-1422557, CCF- 1451986, and IIS-1563950. SG and VY acknowledge partial support from NSF Grant CNS-1314956 and CNS-1514503.

Publisher Copyright:
© 2018 IEEE.

Keywords

DNS
Deinterleaving
LSTM
Malicious domain detection

Access

10.1109/SPW.2018.00024

OpenUrl availability

Full text

Cite this

Asiaee T, A., Goel, H., Ghosh, S., Yegneswaran, V., & Banerjee, A. (2018). Time series deinterleaving of DNS traffic. In Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018 (pp. 103-108). Article 8424640 (Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/SPW.2018.00024

Time series deinterleaving of DNS traffic. / Asiaee T, Amir; Goel, Hardik; Ghosh, Shalini et al.
Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018. Institute of Electrical and Electronics Engineers Inc., 2018. p. 103-108 8424640 (Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Asiaee T, A, Goel, H, Ghosh, S, Yegneswaran, V & Banerjee, A 2018, Time series deinterleaving of DNS traffic. in Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018., 8424640, Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018, Institute of Electrical and Electronics Engineers Inc., pp. 103-108, 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018, San Francisco, United States, 5/24/18. https://doi.org/10.1109/SPW.2018.00024

Asiaee T A, Goel H, Ghosh S, Yegneswaran V, Banerjee A. Time series deinterleaving of DNS traffic. In Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018. Institute of Electrical and Electronics Engineers Inc. 2018. p. 103-108. 8424640. (Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018). doi: 10.1109/SPW.2018.00024

@inproceedings{09266d22d6644d3690835e66f52611d6,

title = "Time series deinterleaving of DNS traffic",

abstract = "Stream deinterleaving is an important problem with various applications in the cybersecurity domain. In this paper, we consider the specific problem of deinterleaving DNS data streams using machine-learning techniques, with the objective of automating the extraction of malware domain sequences. We first develop a generative model for user request generation and DNS stream interleaving. Based on these we evaluate various inference strategies for deinterleaving including augmented HMMs and LSTMs on synthetic datasets. Our results demonstrate that state-of-the-art LSTMs outperform more traditional augmented HMMs in this application domain.",

keywords = "DNS, Deinterleaving, LSTM, Malicious domain detection",

author = "{Asiaee T}, Amir and Hardik Goel and Shalini Ghosh and Vinod Yegneswaran and Arindam Banerjee",

note = "Funding Information: The work was supported in part by NSF grants CNS- 1314560, IIS-1447566, IIS-1447574, IIS-1422557, CCF- 1451986, and IIS-1563950. SG and VY acknowledge partial support from NSF Grant CNS-1314956 and CNS-1514503. Publisher Copyright: {\textcopyright} 2018 IEEE.; 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018 ; Conference date: 24-05-2018",

year = "2018",

month = aug,

day = "2",

doi = "10.1109/SPW.2018.00024",

language = "English (US)",

isbn = "9780769563497",

series = "Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "103--108",

booktitle = "Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018",

}

TY - GEN

T1 - Time series deinterleaving of DNS traffic

AU - Asiaee T, Amir

AU - Goel, Hardik

AU - Ghosh, Shalini

AU - Yegneswaran, Vinod

AU - Banerjee, Arindam

N1 - Funding Information: The work was supported in part by NSF grants CNS- 1314560, IIS-1447566, IIS-1447574, IIS-1422557, CCF- 1451986, and IIS-1563950. SG and VY acknowledge partial support from NSF Grant CNS-1314956 and CNS-1514503. Publisher Copyright: © 2018 IEEE.

PY - 2018/8/2

Y1 - 2018/8/2

N2 - Stream deinterleaving is an important problem with various applications in the cybersecurity domain. In this paper, we consider the specific problem of deinterleaving DNS data streams using machine-learning techniques, with the objective of automating the extraction of malware domain sequences. We first develop a generative model for user request generation and DNS stream interleaving. Based on these we evaluate various inference strategies for deinterleaving including augmented HMMs and LSTMs on synthetic datasets. Our results demonstrate that state-of-the-art LSTMs outperform more traditional augmented HMMs in this application domain.

AB - Stream deinterleaving is an important problem with various applications in the cybersecurity domain. In this paper, we consider the specific problem of deinterleaving DNS data streams using machine-learning techniques, with the objective of automating the extraction of malware domain sequences. We first develop a generative model for user request generation and DNS stream interleaving. Based on these we evaluate various inference strategies for deinterleaving including augmented HMMs and LSTMs on synthetic datasets. Our results demonstrate that state-of-the-art LSTMs outperform more traditional augmented HMMs in this application domain.

KW - DNS

KW - Deinterleaving

KW - LSTM

KW - Malicious domain detection

UR - http://www.scopus.com/inward/record.url?scp=85052216719&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85052216719&partnerID=8YFLogxK

U2 - 10.1109/SPW.2018.00024

DO - 10.1109/SPW.2018.00024

M3 - Conference contribution

AN - SCOPUS:85052216719

SN - 9780769563497

T3 - Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018

SP - 103

EP - 108

BT - Proceedings - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2018 IEEE Symposium on Security and Privacy Workshops, SPW 2018

Y2 - 24 May 2018

ER -

Time series deinterleaving of DNS traffic

Abstract

Publication series

Other

Bibliographical note

Keywords

Access

OpenUrl availability

Other files and links

Fingerprint

Cite this