FANCI : Feature-based Automated NXDomain Classification and Intelligence
summary
FANCI is an NXDomain classifier that uses 21 features (12 structural, 7 linguistic, 2 statistical) and a random forest model trained on DGArchive DGAs and large campus and corporate DNS logs (≈35M and 31M unique NXDs). It achieves >99% true positive rate and very low false positive rate on known DGAs, holds up in leave-one-out tests (slightly lower TPR, stable FPR), runs ~400 predictions/sec single-threaded over 700M NXDs, and surfaces actionable results — reporting 405 unknown DGA domains grouped into 10 candidate DGAs.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:59Domain Generation Algorithm (DGA)
- 2:11The Challenge
- 3:34FANCI'S Architecture
- 4:35Classification
- 5:16Feature Design
- 6:25Data Set
- 11:36Generaluation
- 13:13Real World Aplication Setup
- 14:20Real World Application Results
- 15:46Summary
related talks
33mIDACUT: Inspecting DNS Anomalies Crossing Uncertain Times
13mFENIX: Enabling In-Network DNN Inference with FPGA-Enhanced Programmable Switches
31mAttack Hunting with Threat Intelligence
26mk-fingerprinting: A Robust Scalable Website Fingerprinting Technique
27mAgentic Cyber Defense with External Threat Intelligence
28mNeural Networks with RubyFANN
56mFIRSTCON21 - June 8 | Stream 3 Part 1 (12:00-13:00 UTC)
58mThe Security Wolf of Wall Street: Fighting Crime With High-Frequency Classification and...