.png){kind=icon}
返回
On DGA Detection and Classification Using P4 Programmable Switches
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2024.104007.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Domain Generation Algorithms (DGAs) are highly effective strategies employed by malware to establish connections with Command and Control (C2) servers. Mitigating DGAs in high-speed networks can be challenging, as it often requires resource-intensive tasks such as extracting high-dimensional features from domain names or collecting extensive network heuristics. In this paper, we propose an innovative framework leveraging the flexibility, per-packet granularity, and Terabits per second (Tbps) processing capabilities of P4 programmable data plane switches for the rapid and accurate detection and classification of DGA families. Specifically, we use P4 switches to extract a combination of unique network heuristics and domain name features through shallow and Deep Packet Inspection (DPI) with minimal impact on throughput. We employ a two-fold approach, comprising a line-rate compact Machine Learning (ML) classifier in the data plane for DGA detection and a more comprehensive classifier in the control plane for DGA detection and classification. To validate our approach, we collected malware samples totaling hundreds of Gigabytes (GBs), representing over 50 DGA families, and utilized campus traffic from normal benign users. Our results demonstrate that our proposed approach can swiftly and accurately detect DGAs with an accuracy of 97% and 99% in the data plane and the control plane, respectively. Furthermore, we present promising findings and preliminary results for detecting DGAs in encrypted Domain Name System (DNS) traffic. Our framework enables the immediate halting of malicious communications, empowering network operators to implement effective mitigation, incident management, and provisioning strategies.
Keyword:
DGA detection and classification
P4 programmable switches
High-speed networks
Machine learning
DPI
Encrypted DNS traffic
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
An Exhaustive Survey on P4 Programmable Data Plane Switches: Taxonomy, Applications, Challenges, and Future TrendsP4可编程数据平面交换机的详尽调查: 分类，应用，挑战和未来趋势.png)
IEEE ACCESS
OAAI
IEEE ACCESSIF3.6
OAAI分享收藏A survey on data plane programming with P4: Fundamentals, advances, and applied researchP4数据平面编程综述: 基础、进展和应用研究OAAI
OAAI分享收藏Detecting Algorithmically Generated Domain-Flux Attacks With DNS Traffic Analysis通过DNS流量分析检测算法生成的域流量攻击
PREAI
分享收藏分享收藏
查看更多内容