Joint detection of malicious domains and infected clients
From MaRDI portal
Publication:2320564
Abstract: Detection of malware-infected computers and detection of malicious web domains based on their encrypted HTTPS traffic are challenging problems, because only addresses, timestamps, and data volumes are observable. The detection problems are coupled, because infected clients tend to interact with malicious domains. Traffic data can be collected at a large scale, and antivirus tools can be used to identify infected clients in retrospect. Domains, by contrast, have to be labeled individually after forensic analysis. We explore transfer learning based on sluice networks; this allows the detection models to bootstrap each other. In a large-scale experimental study, we find that the model outperforms known reference models and detects previously unknown malware, previously unknown malware families, and previously unknown malicious domains.
Recommendations
- scientific article; zbMATH DE number 6102665
- A novel semantic-aware approach for detecting malicious web traffic
- Learning to detect and classify malicious executables in the wild
- Malware detection using machine learning
- Learning to control a structured-prediction decoder for detection of HTTP-layer DDoS attackers
Cites work
- A Bayesian/information theoretic model of learning to learn via multiple task sampling
- Convex multi-task feature learning
- Domain-adversarial training of neural networks
- Hyperband: a novel bandit-based approach to hyperparameter optimization
- Learning multiple tasks with kernel methods
- On inferring application protocol behaviors in encrypted network traffic
- Scikit-learn: machine learning in Python
Cited in
(4)- To clean or not to clean: malware removal strategies for servers under load
- A novel semantic-aware approach for detecting malicious web traffic
- Learning to control a structured-prediction decoder for detection of HTTP-layer DDoS attackers
- Web Canary: A virtualized web browser to support large-scale silent collaboration in detecting malicious web sites
This page was built for publication: Joint detection of malicious domains and infected clients
Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q2320564)
