The Deep Learning Vision for Heterogeneous Network Traffic Control: Proposal, Challenges, and Future Perspective

2017 ◽  
Vol 24 (3) ◽  
pp. 146-153 ◽  
Author(s):  
Nei Kato ◽  
Zubair Md. Fadlullah ◽  
Bomin Mao ◽  
Fengxiao Tang ◽  
Osamu Akashi ◽  
...  
2018 ◽  
Vol 25 (4) ◽  
pp. 74-81 ◽  
Author(s):  
Bomin Mao ◽  
Fengxiao Tang ◽  
Zubair Md. Fadlullah ◽  
Nei Kato ◽  
Osamu Akashi ◽  
...  

2017 ◽  
Vol 19 (4) ◽  
pp. 2432-2455 ◽  
Author(s):  
Zubair Md. Fadlullah ◽  
Fengxiao Tang ◽  
Bomin Mao ◽  
Nei Kato ◽  
Osamu Akashi ◽  
...  

IEEE Network ◽  
2018 ◽  
Vol 32 (6) ◽  
pp. 66-73 ◽  
Author(s):  
Anish Jindal ◽  
Gagangeet Singh Aujla ◽  
Neeraj Kumar ◽  
Rajat Chaudhary ◽  
Mohammad S. Obaidat ◽  
...  

2019 ◽  
Vol 6 (1) ◽  
pp. 953-966 ◽  
Author(s):  
Jinglin Li ◽  
Guiyang Luo ◽  
Nan Cheng ◽  
Quan Yuan ◽  
Zhiheng Wu ◽  
...  

2021 ◽  
Vol 2 (2) ◽  
Author(s):  
Kate Highnam ◽  
Domenic Puzio ◽  
Song Luo ◽  
Nicholas R. Jennings

AbstractBotnets and malware continue to avoid detection by static rule engines when using domain generation algorithms (DGAs) for callouts to unique, dynamically generated web addresses. Common DGA detection techniques fail to reliably detect DGA variants that combine random dictionary words to create domain names that closely mirror legitimate domains. To combat this, we created a novel hybrid neural network, Bilbo the “bagging” model, that analyses domains and scores the likelihood they are generated by such algorithms and therefore are potentially malicious. Bilbo is the first parallel usage of a convolutional neural network (CNN) and a long short-term memory (LSTM) network for DGA detection. Our unique architecture is found to be the most consistent in performance in terms of AUC, $$F_1$$ F 1 score, and accuracy when generalising across different dictionary DGA classification tasks compared to current state-of-the-art deep learning architectures. We validate using reverse-engineered dictionary DGA domains and detail our real-time implementation strategy for scoring real-world network logs within a large enterprise. In 4 h of actual network traffic, the model discovered at least five potential command-and-control networks that commercial vendor tools did not flag.


Sign in / Sign up

Export Citation Format

Share Document