Botnet Domain Generation Algorithm (DGA) Detection Evasion

Summary

The Palo Alto Networks Security AI research team was able to bypass a Convolutional Neural Network based botnet Domain Generation Algorithm (DGA) detector using a generic domain name mutation technique. It is a generic domain mutation technique which can evade most ML-based DGA detection modules. The generic mutation technique evades most ML-based DGA detection modules DGA and can be used to test the effectiveness and robustness of all DGA detection methods developed by security companies in the industry before they is deployed to the production environment. Target: Palo Alto Networks ML-based DGA detection module Actor: Palo Alto Networks AI Research Team Procedure: 1. DGA detection is a widely used technique to detect botnets in academia and industry. The research team searched for research papers related to DGA detection. 2. The researchers acquired a publicly available CNN-based DGA detection model and tested it against a well-known DGA generated domain name data sets, which includes ~50 million domain names from 64 botnet DGA families. The CNN-based DGA detection model shows more than 70% detection accuracy on 16 (~25%) botnet DGA families. 3. The researchers developed a generic mutation technique that requires a minimal number of iterations. 4. The researchers used the mutation technique to generate evasive domain names. 5. The experiment results show that the detection rate of all 16 botnet DGA families drop to less than 25% after only one string is inserted once to the DGA generated domain names. 6. The DGA generated domain names mutated with this technique successfully evade the target DGA Detection model, allowing an adversary to continue communication with their [Command and Control](https://attack.mitre.org/tactics/TA0011/) servers.

Deployers

• Palo Alto Networks ML-based DGA detection module

Tags

• MITRE ATLAS
• AML.CS0001