IDACUT: Inspecting DNS Anomalies Crossing Uncertain Times
summary
A production pipeline ingests ~100M daily DNS logs via Logstash, Kafka and Spark into a scalable store and runs ensemble detectors: a character-level LSTM for DGA-like subdomains (≈90% recall on test DGA), feature extraction plus random forest 98.6% (SVM 96.2%) for tunnel-vs-benign classification, and an LSTM autoencoder time-series outlier detector that flags domains with 100x reconstruction error — 3,453 domains over 171 days yield five confirmed DNS-tunnel/Cobalt Strike beacon campaigns.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 5:53DNS Attacks
- 12:59Framework
- 13:11Overview
- 16:01Part 1 Abnormal Subdomain Detection
- 18:58Part 2 Domain Name Reputation
- 26:09Part 3 Outlier Detection
- 30:42Conclusion
related talks
50mDeep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge
52mAI in Cybersecurity & Fraud Prevention
58mThe Security Wolf of Wall Street: Fighting Crime With High-Frequency Classification and...
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
59mCatching Malware En Masse: DNS and IP Style
25mDark Side of the DNS Force
32mDNS as Added Security Against Ransomware Attacks
32mSomething’s Phishy: See the Hook Before the Bait