拦截冰雹水螅：气象生成区域的实时的探测
Intercepting Hail Hydra: Real-Time Detection of Algorithmically Generated Domains
摘要：
网络犯罪分子面临的一个关键技术挑战是，在不影响其攻击鲁棒性的情况下，控制构建僵尸网络的数百万台可能受感染的设备。例如，一个固定的C&C服务器可以通过二进制或流量分析进行简单的检测，并立即被安全研究人员或执法部门发现或拆除。僵尸网络通常使用域生成算法（DGAs），主要是为了逃避攻击。DGAs可以延长恶意软件活动的生命周期，从而潜在地提高其盈利能力。它们还可能有助于阻碍对攻击行为追究责任。在这项工作中，我们介绍了HYDRAS，最全面和最具代表性的数据集的自动生成域（AGD）的日期。该数据集包含100多个DGA家族，包括真实世界和逆向设计的家族。我们分析了数据集，并讨论了实时的【形】区分良性请求（真实域）和恶意请求（AGD）的可能性。同时研究这么多的家庭和变种介绍了几个挑战;然而，它消除了偏见，发现在以前的文献中采用小的数据集，经常过度拟合，利用特定的家庭，不概括的特点，以及。我们彻底比较我们的方法与当前的国家的最先进的，并强调在实践中的实际状态的一些方法上的缺点。所获得的结果表明，我们提出的方法显着优于目前的最先进的分类性能和效率方面。
英文摘要：
A crucial technical challenge for cybercriminals is to keep control over the potentially millions of infected devices that build up their botnets, without compromising the robustness of their attacks. A single, fixed C&C server, for example, can be trivially detected either by binary or traffic analysis and immediately sink-holed or taken-down by security researchers or law enforcement. Botnets often use Domain Generation Algorithms (DGAs), primarily to evade take-down attempts. DGAs can enlarge the lifespan of a malware campaign, thus potentially enhancing its profitability. They can also contribute to hindering attack accountability. In this work, we introduce HYDRAS, the most comprehensive and representative dataset of Algorithmically-Generated Domains (AGD) available to date. The dataset contains more than 100 DGA families, including both real-world and adversarially designed ones. We analyse the dataset and discuss the possibility of differentiating between benign requests (to real domains) and malicious ones (to AGDs) in real-time. The simultaneous study of so many families and variants introduces several challenges; nonetheless, it alleviates biases found in previous literature employing small datasets which are frequently overfitted, exploiting characteristic features of particular families that do not generalise well.We thoroughly compare our approach with the current state-of-the-art and highlight some methodological shortcomings in the actual state of practice. The outcomes obtained show that our proposed approach significantly outperforms the current state-of-the-art in terms of both classification performance and efficiency.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
