开放式SESAME：用域生成算法的种子重构对抗僵尸网络
Open SESAME: Fighting Botnets with Seed Reconstructions of Domain Generation Algorithms
摘要：
许多僵尸网络的一个重要方面是它们使用域生成算法（DGAs）生成伪随机域名的能力。网络犯罪分子可以注册这样的域名，以建立定期变化的与机器人的会合点。DGAs使用种子来生成域集合。种子可以很容易地改变，以便在使用相同的底层算法的同时生成全新的域组。虽然这对对手来说只需要很少的手动工作，但安全专家通常必须手动对新的恶意软件菌株进行逆向工程以重建种子。只有当种子和DGA是已知的，过去和未来的域可以生成，有效地归因，阻止，下沉或用于取下。文献中常见的计数器由数据库或基于机器学习（ML）的检测器组成，以分别跟踪已知DGA的过去和未来域并识别DGA生成的域名。然而，基于数据库的方法不能检测由新的DGA生成的域，并且ML方法不能生成未来的域名。在本文中，我们将介绍SEMPERT，一个系统，结合了上述两种方法，并包含一个自动种子重建模块，这是，据我们所知，第一个同类。它用于自动分类域名，评价其新颖性，并确定底层DGA的种子。SESearchTM由多个特定于DGA的种子重建器组成，设计为纯粹基于域名工作，因为它们可以通过观察网络流量轻松获得。我们在20.8千兆字节的DNS查找上评估了我们的方法。因此，我们确定了17个DGA，其中4个是我们全新的。
英文摘要：
An important aspect of many botnets is their capability to generate pseudorandom domain names using Domain Generation Algorithms (DGAs). A cyber criminal can register such domains to establish periodically changing rendezvous points with the bots. DGAs make use of seeds to generate sets of domains. Seeds can easily be changed in order to generate entirely new groups of domains while using the same underlying algorithm. While this requires very little manual effort for an adversary, security specialists typically have to manually reverse engineer new malware strains to reconstruct the seeds. Only when the seed and DGA are known, past and future domains can be generated, efficiently attributed, blocked, sinkholed or used for a take-down. Common counters in the literature consist of databases or Machine Learning (ML) based detectors to keep track of past and future domains of known DGAs and to identify DGA-generated domain names, respectively. However, database based approaches can not detect domains generated by new DGAs, and ML approaches can not generate future domain names. In this paper, we introduce SESAME, a system that combines the two above-mentioned approaches and contains a module for automatic Seed Reconstruction, which is, to our knowledge, the first of its kind. It is used to automatically classify domain names, rate their novelty, and determine the seeds of the underlying DGAs. SESAME consists of multiple DGA-specific Seed Reconstructors and is designed to work purely based on domain names, as they are easily obtainable from observing the network traffic. We evaluated our approach on 20.8 gigabytes of DNS-lookups. Thereby, we identified 17 DGAs, of which 4 were entirely new to us.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
