We recently launched Elastic Security, combining the threat hunting and analytics tools from <a href="/products/siem" target="_self">Elastic SIEM</a> with the prevention and response features of <a href="/products/endpoint-security" target="_self">Elastic Endpoint Security</a>. This combined solution focuses on detecting and flexibly responding to security threats, with machine learning providing core capabilities for real-time protections, detections, and interactive hunting. But why are machine learning tools so important in information security? How is machine learning being applied? In this first of a two-part blog series, we’ll motivate the "why" and explore the "how," highlighting malware prevention via supervised machine learning in Elastic Endpoint Security. In a follow-up, we’ll highlight where machine learning plays a role in detecting anomalous behavior from the global view of Elastic SIEM.<h2>Malicious activity: a case study</h2>Even as the United States prepares for the 2020 election cycle, a three-year anniversary of an <a href="https://www.cnet.com/news/how-the-russian-hackers-infiltrated-the-dnc-a-timeline/" target="_self">infamous cyber attack</a> is still top of mind.On Tuesday, March 15, 2016, threat actors allegedly from the advanced persistent threat (APT) Group 28 (aka “Fancy Bear”) began port scanning servers at the Democratic National Committee. This was part of a broader reconnaissance effort that adversaries commonly perform against a target. By Saturday, the adversary had delivered a spear-phishing email to the campaign chairman to gain access to his email account. Although recipients noted it as suspicious, the attack worked: by Monday, the threat group had compromised the chairman’s email account and stolen more than 50 thousand emails. Then, from a new email account created by attackers within the DNC domain (with a name similar to the account of a recognized DNC staffer), a spreadsheet named “candidate favorability ratings” was delivered to 30 DNC staffers. At least one recipient opened the spreadsheet and enabled a macro, which resulted in a local user account being hacked.In the weeks that followed, a common playbook of tactics unfolded in what is now eponymously known as the DNC hack. Like other APT groups, while the specific techniques deployed are circumstantially tailored, the broader tactics are repeated in attack after attack (and thus codified by MITRE). The attack process typically follows some variation of the following steps:<ul><li>Human exploitation leads to account theft.</li><li>Attackers establish persistence, use existing tools or install command-and-control malware (in the case of the DNC hack, X-Agent) that allow them to log keystrokes, take screenshots, and otherwise “land and expand” into other servers on the network.</li><li>Attackers collect, compress, and consume a surfeit of data.</li><li>Logs are scrubbed and digital footprints are delicately swept away.</li><li>The threat group goes dormant, becoming difficult to fully root out, even if their presence is detected on a single device (in the case of the DNC hack, although X-Agent was disabled on June 20 — 97 days after the initial reconnaissance — a Linux version of the malware remained through October).</li></ul>It’s not difficult to understand why unified protections and comprehensive event management are important in a case like this. Unfortunately, being compromised has become a fact of life, and security organizations aim to stop an attacker early in the execution of their plan. Thus, most of the energy traditionally spent in security has been toward detection mechanisms that reduce the dwell time of an attacker post-compromise. Since attacker tools and techniques vary, rules crafted for specific adversary techniques and machine learning trained to catch more general behaviors have been used to detect almost every point along the attacker’s natural progression from reconnaissance to delivery; exploitation to exfiltration.The <a href="https://attack.mitre.org/" target="_self">MITRE Corporation</a> began developing a globally accessible knowledge base of adversary tactics and techniques (ATT&amp;CK) based on real-world observations in 2014, which has now grown to codify 266 specific techniques, including many created or enhanced by community <a href="https://www.mitre.org/capabilities/cybersecurity/overview/cybersecurity-blog/the-philosophy-of-attck" target="_self">contributions of information</a>. The MITRE ATT&amp;CK matrix is now the most comprehensive adversary model and framework for describing the actions an adversary may take to compromise and operate within an enterprise network.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltfbac7da809939393/5ddc4ca316efc60c370c15af/ml-cybersecurity-mitre-framework-blog.jpg" data-sys-asset-uid="bltfbac7da809939393" alt="Mitre Attack matrix" style="display: block;margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;"/><a href="https://attack.mitre.org/" target="_self"> </a><h2>Why machine learning?</h2>Machine learning offers an attractive paradigm for scaling the detection of adversarial behaviors and their tools, largely owing to the following:<ul><li>Automation — Coarsely, security has historically been tackled by throwing experts at data to produce rules, heuristics, and analytics in a repetitive process of cat-and-mouse. One natural outcome of machine learning is the repurposing of security experts to engineer automation processes — including machine learning training infrastructures — rather than spending cycles on the most repetitive tasks of detection creation. In this way, it’s the algorithms, not valued experts, that are tackling the mundane tasks, occasionally overseen, curated, and refined by security experts where appropriate.</li><li>Discovery of sophisticated relationships — Human experts are still best positioned to pinpoint causal indicators of threat behavior. For example, a reverse engineer may disassemble and isolate a particular code block encapsulating nefarious behavior. However, machine learning is exceedingly good at finding useful correlations from data that can’t easily be discovered manually. For example, some combination of file size, imported functions, resource table usage, and properties of the .text section might isolate a 99.99% pure set of malicious files in the training data. While this isn’t a smoking gun for malicious behavior, it may offer enough evidence to convict a file, process, or user of malintent.</li><li>Generalization with less brittleness — The discovered patterns tend to generalize toward new malware strains, similar tactics, or sketchy user behavior in a way that is less brittle than hand-crafted rules. <a href="https://www.elastic.co/blog/may-2023-launch-machine-learning-models" target="_self">Machine learning models</a> are often shaped in a way that a file, process, or behavior is not convicted as a binary “good” or “bad,” but instead produces a score that smoothly transitions between areas convicted as “good” and areas convicted as “bad.” Importantly, a model is generated from the data. All real-world machine learning models are in some sense “<a href="https://en.wikipedia.org/wiki/All_models_are_wrong" target="_self">wrong</a>,” in that they do not perfectly summarize their training data. However, they are “useful” in their very specific task of rendering judgements on samples that are similar to those in their training set. They have “learned” to generalize.</li></ul><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blta0f4392313f43879/5ddc4cead800b20c30e1ab85/ml-cybersecurity-space-code-blog.jpg" data-sys-asset-uid="blta0f4392313f43879" alt="Malware mapping 1" style="display: block;margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;"/> <img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt4fdf6710c32a32da/5ddc4d07d800b20c30e1ab8b/ml-cybersecurity-space-size-blog.jpg" data-sys-asset-uid="blt4fdf6710c32a32da" alt="Malware mapping 2" style="display: block;margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;"/><h3>No free security lunch</h3>Marketing campaigns notwithstanding, machine learning has generally been a benefit to security. But, the truth is that machine learning for security brings a number of substantive challenges:<ul><li>False positives — When compared to hand-crafted rules and heuristics, machine learning generally trades an increased “true positive rate” (detect new behavior) for a modest increase in false positives (FPs). While the FP rate is still less than, say, 1 in 2000, this is discouraging when the model chooses your favorite application to flag as malicious. “Fixing” a FP is not straightforward. To borrow a <a href="https://pbs.twimg.com/media/EHHdPcCXUAABs3d.jpg" target="_self">concept</a> from Microsoft, the challenge of deploying machine learning is that “one doesn’t so much fix errors in ML as much as encourage toward the correct answer.” In fatalistic irony, FPs actually increase analyst workload, reducing the overall effectiveness of a solution, especially when defenders respond to FPs by the <a href="https://www.reuters.com/article/us-target-breach/target-says-it-declined-to-act-on-early-alert-of-cyber-breach-idUSBREA2C14F20140313" target="_self">age-old approach</a> of ignoring or turning off alerting.</li><li>Explainability — In many cases, from a human’s perspective, the results of a machine learning model may seem incoherent or inconsistent. Trust is paramount in security, and the explainability of a model may be at odds with its sophistication and accuracy. Indeed, when offered, some explanations of model decision come across as trend diagnosis, e.g., “this file is malicious because of imports and high entropy in .text,” which does not provide a true explanation, but instead reinforces a notion that machine learning amounts to “bias automation.”</li><li>Adversarial drift — Dataset drift in machine learning is present in many applications due to the natural evolution of observations. In security, where an adversary — a who not a what — is the focus of observed data, the drift is driven in an adversarial way: an adversary is incentivized to adjust behaviors to evade defensive detections. In this scenario, the fundamental assumption of machine learning — that the training conditions of a model are identical to deployment conditions — is broken. Instead, this assumption must be relaxed to “deployment conditions are almost identical to training conditions for some period of time [until they aren’t].” To keep up, defenders must recollect, retrain, and redeploy machine learning models, typically at a much slower pace than brittle signature and rule-based approaches.</li></ul>Tackling these and other considerations motivate the need for security data science and engineering at Elastic. So, where have we applied machine learning? Here, we’ll describe where machine learning plays a role in Elastic Endpoint Security protections. In a follow-up, we’ll highlight where it plays a role in detecting and searching from bulk event data in Elastic SIEM.<h2>Endpoint security protections: MalwareScore™</h2>Both custom and common software tools are employed by threat actors across all tactics in the MITRE ATT&amp;CK framework. In particular, custom software, macros, or scripts may be used to gain initial access, access credentials, establish command-and-control communications, or render the adversary’s desired impact, such as data encryption for ransomware. MalwareScore is a prevention in Elastic Endpoint Security that detects these malicious files via a trained machine learning model.<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt3cb8a6fb972d45e9/5ddc4df66afb810c2d465f63/ml-cybersecurity-ml-model-blog.png" data-sys-asset-uid="blt3cb8a6fb972d45e9" alt="MalwareScore machine learning model" style="display: block;margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;"/><figcaption>Parsing files effectively to generate features and train MalwareScore models</figcaption>Writing rules or heuristics for every type of known malicious software tool is not sustainable, especially as malware variants evolve. Instead, MalwareScore leverages the scale and automation benefits of machine learning. MalwareScore models are trained to generalize from patterns discovered in large corpora of malicious and benign files: exceeding 150M files for Windows executable files for recent model versions.MalwareScore consists of three malicious software models: Windows PE files, macro-based Office documents, and macOS binaries (Mach-O). We apply domain expertise from our threat intelligence team to identify features of these files important in determining whether the file is likely good or bad. For instance, Windows PE files are summarized by features that are derived from aspects of the file that include:<ul><li>Header and rich signature</li><li>File section characteristics</li><li>Version data</li><li>Debug info included by the compiler</li><li>Imported and exported functions</li><li>The overlay (appended to the file)</li><li>Resources section</li><li>The entry point</li><li>Thread local storage callbacks</li><li>The distribution of byte patterns in the file</li></ul>Mach-O binaries are summarized from similar information. Macros embedded within Office documents are characterized by both macro content and document properties.Features like those listed above are readily converted into a format (vector of numbers) that can be ingested and analyzed by machine learning algorithms. MalwareScore leverages <a href="https://en.wikipedia.org/wiki/Gradient_boosting" target="_self">gradient boosting decision trees</a> because these model types offer a nice combination of excellent efficacy (high detection rate with a low false positive rate) and computational simplicity (essentially, a series of if/then statements). Indeed, the models are designed to be lightweight (roughly 5MB) with low CPU utilization.MalwareScore is a supervised machine learning model, meaning that each file is paired with a malicious or benign label. The model is trained to minimize prediction errors of these target labels on the training set, with model regularization employed so that the model generalizes to samples not in the training set, rather than just memorizing. While the features and the model type are important, the richness and distribution of the training data and the quality of the labels are fundamental to providing a good model.<h2>What’s next?</h2>MalwareScore-supervised machine learning models bring an important element of protection to the Elastic Stack. Users who install Elastic Endpoint Security are protected against malware as part of a layered protection strategy that includes behavioral rules. You can try a recent version of MalwareScore in <a href="https://www.virustotal.com/gui/home/search" target="_self">VirusTotal</a>. Upload or search for a PE, macro, or Mach-O file, and view the results yourself!An even broader security and operational perspective can be attained in Elastic SIEM. In addition to endpoint events collected by Elastic Endpoint Security or other technologies, the SIEM app may include audit events, authentication logs, and firewall logs in holistic detail. In the next blog, we’ll discuss how machine learning in Elastic SIEM can be used to expose unknown threats via anomaly detection in an unsupervised learning paradigm. This allows you to protect against behaviors at the endpoint, and discover unexpected behavior in Elastic SIEM.

ml-cybersecurity-blog-banner.jpg

ml-cybersecurity-blog-thumb.png

Machine learning for cybersecurity: only as effective as your implementation

The presence of domain names created by a Domain Generation Algorithm (DGA) is a telling indicator of compromise. For example, the domain xeogrhxquuubt.com is a DGA generated domain created by the Cryptolocker ransomware. If a process attempts to connect to this domain, then your network is probably infected with ransomware. Domain blacklists are commonly used in security to prevent connections to such domains, but this blacklisting approach doesn’t generalize to new strains of malware or modified DGA algorithms. We have been researching DGAs extensively at Endgame, and recently posted a <a href="https://arxiv.org/abs/1611.00791">paper on arxiv</a> that describes our ability to predict domain generation algorithms using deep learning.
In this blogpost, we’ll briefly summarize our paper, presenting a basic yet powerful technique to detect DGA generated domains that performs far better than “state-of-the-art” techniques presented in academic conferences and journals. “How?” you may ask. Our approach is to use neural networks (more popularly called deep learning) and more specifically, Long Short-Term Memory networks (LSTMs). We’ll briefly discuss the benefits of this specific form of deep learning and then cover our simple yet powerful approach for detecting DGA algorithms.
If you are unfamiliar with machine learning, you may want to jump over to our <a href="https://www.endgame.com/blog/machine-learning-you-gotta-tame-beast-you-let-it-out-its-cage">three part intro series</a> on machine learning before continuing on.
<h2>The Benefits of Long Short-Term Memory Networks</h2>Deep learning is a recent buzzword in the machine learning community. Deep learning refers to deeply-layered neural networks (one type of machine learning model), in which feature representations are learned by the model rather than hand-crafted by a user. With roots that go back decades, deep learning has become wildly popular in the last four-five years in large part due to improvements in hardware (such as improved parallel processing with GPUs) and optimization tricks that make training complex networks feasible. LSTMs are one such trick for implementing recurrent neural networks, meaning a neural network that contains cycles. LSTMs are extremely good at learning patterns in long sequences, such as text and speech. In our case, we use them to learn patterns in sequences of characters (domain names) so that we can classify them as DGA-generated or not DGA generated.
The benefit of using deep learning over more conventional machine learning algorithms is that we do not require any feature engineering. Conventional approaches generate a long list of features (such as length, vowel to consonant ratio, and n-gram counts) and use these features to distinguish between DGA-generated and not DGA-generated domains (our colleague wrote about this in a previous <a href="https://www.endgame.com/blog/hunting-networks-part-2-higher-order-patterns">post</a>). If an adversary knows your features, they can easily update their DGA to avoid detection. This requires us, as security professionals, to go through a long and arduous process of creating new features to stay ahead. In deep learning, on the other hand, the model learns the feature representations automatically allowing our models to adapt more quickly to an ever-changing adversary.
Another advantage to our technique is that we classify solely on the domain name without the use of any contextual features such as NXDomains and domain reputation. Contextual features can be expensive to generate and often require additional infrastructure (such as network sensors and third party reputations systems). Surprisingly, LSTMs without contextual information perform significantly better than current state of the art techniques that do use contextual information! For those who want to know more about LSTMs, tutorials are plentiful. Two that we recommend: <a href="https://colah.github.io/posts/2015-08-Understanding-LSTMs/">colah’s blog</a> and <a href="http://deeplearning.net/tutorial/lstm.html">deeplearning.net</a>, and of course our <a href="https://arxiv.org/abs/1611.00791">paper</a> on arxiv.
<h2>What is a DGA?</h2>First, a quick note on what a DGA is and why detecting DGAs is important. Adversaries often use domain names to connect malware to command and control servers. These domain names are coded into malware and give the adversary some flexibility in where the C2 is actually hosted in that it’s easy for them to update the domain name to point to a new IP. However, hardcoded domain names are easy to blacklist or sinkhole.
Adversaries use DGAs to evade blacklisting and sinkholing by creating an algorithm (DGA) that creates pseudorandom strings that can be used as domain names. Pseudorandom means that the sequences of strings appear to be random but are actually repeatable given some initial state (or seed). This algorithm is used by both malware that runs on a victim’s machine as well as on some remote software used by the adversary.
On the adversary side, the attacker runs the algorithm and randomly selects a small number of domains (sometimes just one) which he knows will be predicted by the DGA, registers them, and points them at C2 servers. On the victim side, malware runs the DGA and checks an outputted domain to see if it’s live. If a domain is registered, the malware uses this domain as its Command and Control (C2) server. If not, it checks another. This can happen hundreds or thousands of times.
If security researchers gather samples and can reverse engineer the DGA, they can generate lists of all possible domains or pre-register domains which will be predicted in the future and use them for blacklisting or sinkholing, but this doesn’t scale particularly well since thousands or more domains can be generated by a DGA for a given day, with an entirely new list each following day. As you can see, a more generalized approach for predicting whether a given domain name is likely generated by a DGA would be ideal. That generalized approach is what we’re describing here.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltff6e7b941805f9d6/5e0e011df5916f4381bc9717/endgame-detecting-dgas-discovery-process-blog.jpeg" data-sys-asset-uid="bltff6e7b941805f9d6" alt="endgame-detecting-dgas-discovery-process-blog.jpeg" style="display: block; margin: auto;"><figcaption>Figure 1 demonstrates the discovery process used by many types of malware. In this case, the malware attempts three domains: asdfg.com, wedcf.com, and bjgkre.com. The first two domains are not registered and receive an NXDomain response from the DNS server. The third domain is registered and the malware uses this domain to call home.
</figcaption><h2>Building the LSTM</h2><h3>Training Data</h3>Any machine learning model requires training data. Luckily, training data for this task is easy to find. We used the Alexa top 1 million sites for <a href="https://s3.amazonaws.com/alexa-static/top-1m.csv.zip">benign data</a>. We also put together a few DGA algorithms in Python that you can grab on our <a href="https://github.com/endgameinc/dga_predict">github site</a>. We use these to generate malicious data. These will generate all the data needed to reproduce the results in this blog.
<h3>Tools and Frameworks</h3>We used the <a href="https://keras.io/">Keras</a> toolbox, which is a Python library that makes coding neural networks easy. There are other tools that we like, but Keras is the easiest to demo and understand. Keras is stable and production ready as it uses either <a href="http://deeplearning.net/software/theano/">Theano</a> or <a href="https://www.tensorflow.org/">TensorFlow</a> under the hood.
<h3>Model Code</h3>The following is our Python code for building our model:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blted5613c682037f91/5e0e015d4dfaba3e76b44caa/endgame-detecting-dgas-python-model-blog.png" data-sys-asset-uid="blted5613c682037f91" alt="endgame-detecting-dgas-python-model-blog.png" style="display: block; margin: auto;">Yup, that’s it! Here is a very simple breakdown of what we’re doing (with links to additional information):
<ul>
	<li>We create a basic neural network model on the first line. The next line adds an embedding layer. This layer converts each character into a vector of 128 floats (128 is not a magical number. We chose it as it gave us the best numbers consistently). Each character essentially goes through a lookup once this layer is trained (input character and output 128 floats). max_features defines the number of valid characters. input_length is the maximum length string that we will ever pass to our neural network.</li>
	<li>The next line adds an LSTM layer. This is the main workhorse of our technique. 128 represents the number of dimensions in our internal state (this happens to be the same size as our previous embedding layer by coincidence). More dimensions mean a larger more descriptive model, and we found 128 to work quite well for our task at hand.</li>
	<li>The <a href="https://en.wikipedia.org/wiki/Convolutional_neural_network#Dropout">Dropout</a> layer is a trick used in deep learning to prevent overtraining. You can probably remove this, but we found it useful.</li>
	<li>This Dropout layer precedes a Dense layer (<a href="https://en.wikipedia.org/wiki/Convolutional_neural_network#Fully_connected_layer">fully connected layer</a>) of size 1.</li>
	<li>We added a <a href="https://en.wikipedia.org/wiki/Sigmoid_function">sigmoid activation</a> function to squash the output of this layer between 0 and 1, which represent, respectively, benign and malicious.</li>
	<li>We optimize using the <a href="https://en.wikipedia.org/wiki/Cross_entropy">cross entropy loss</a> function with the <a href="https://en.wikipedia.org/wiki/Stochastic_gradient_descent#RMSProp">RMSProp</a> optimizer. RMSProp is a variant of <a href="https://en.wikipedia.org/wiki/Stochastic_gradient_descent">stochastic gradient descent</a> and tends to work very well for recurrent neural networks.</li>
</ul><h2>Preprocessing Code</h2>Before we start training, we must do some basic data preprocessing. Each string should be converted into an array of ints that represents each possible character. This encoding is arbitrary, but should start at 1 (we reserve 0 for the end-of-sequence token) and be contiguous. An example of how this can be done is given below.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltb3b552010d417f4f/5e0e01945f3f935f859311ff/endgame-detecting-dgas-converting-string-blog.png" data-sys-asset-uid="bltb3b552010d417f4f" alt="endgame-detecting-dgas-converting-string-blog.png" style="display: block; margin: auto;">Next, we pad each array of ints to the same length. Padding is a requirement of our toolboxes to better optimize calculations (theoretically, no padding is needed for LSTMs). Fortunately, Keras has a nice function for this:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt945811a5c049fe8a/5e0e01b7631b8140b1f058bb/endgame-detecting-dgas-padding-blog.png" data-sys-asset-uid="blt945811a5c049fe8a" alt="endgame-detecting-dgas-padding-blog.png" style="display: block; margin: auto;">maxlen represents the length that each array should be. This function pads with 0’s and crops when an array is too long. It’s important that your integer encoding from earlier starts at 1 as the LSTM should learn the difference between padding and characters.
From here, we can divide out our testing and training set, train, and evaluate our performance using a ROC curve.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt524ea7fd61ab74f7/5e0e01e3631b8140b1f058c1/endgame-detecting-dgas-roc-curve-blog.png" data-sys-asset-uid="blt524ea7fd61ab74f7" alt="endgame-detecting-dgas-roc-curve-blog.png" style="display: block; margin: auto;"><h4></h4><h2>Comparisons</h2>We compared our simple LSTM technique to three other techniques in our arxiv <a href="https://arxiv.org/abs/1611.00791">paper</a>. To keep things simple for this blog, we only compare the results with a single method that uses <a href="https://en.wikipedia.org/wiki/Bigram">bigram</a> distributions with <a href="https://en.wikipedia.org/wiki/Logistic_regression">logistic regression</a>. This technique also works better than the current state of the art (but not as good as an LSTM) and is surprisingly fast and simple. It is a more conventional feature-based approach where features are the histogram (or raw count) of all bigrams contained within a domain name. The code for this technique is also on our <a href="https://github.com/endgameinc/dga_predict">github</a> site.
<h2>Results</h2>We are finally ready to see some results! And here they are:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt776c174b97d89c32/5e0e020567e97c652d3c85c1/endgame-detecting-dgas-results-blog.png" data-sys-asset-uid="blt776c174b97d89c32" alt="endgame-detecting-dgas-results-blog.png" style="display: block; margin: auto;">Nice! An AUC of 0.9977 with just a few lines of code! All of this is featureless with a simple and straightforward implementation. We actually did a much deeper analysis on a larger and more diverse dataset and observed 90% detection with a 1/10,000 false positive rate, and this can be combined with other approaches outside the scope of this post to improve detection even further. With our LSTM, we even did quite well on multiclass classification, meaning we could classify a piece of malware just by the domains it generated.
<h2>Conclusion</h2>We presented a simple technique using neural networks to detect DGAs. The technique uses no contextual information (such as NXDomains or domain reputation) and performs far better than state of the art. While this was a brief summary of our DGA research, feel free to read our complete <a href="https://arxiv.org/abs/1611.00791">paper on arxiv</a> and explore our code on <a href="https://github.com/endgameinc/dga_predict">github</a>. As always, comments and suggestions are welcome on our github site!

blog-banner-generic-blue.png

blog-thumb-generic-blue.png

Using deep learning to detect DGAs

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Hyrum Anderson

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

提交即表示您确认您已阅读并同意我们的<a href="/cn/legal/elastic-cloud-account-terms" target="_self">服务条款</a>，并且您同意通过您提供的上述联系方式接收<a href="/cn/legal/privacy-statement#how-we-use-the-information" target="_self">所选的通信</a>。如需了解更多信息，或想随时取消订阅，请参阅 <a href="/cn/legal/privacy-statement/" target="_self">Elastic 的隐私声明</a>。

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

提交即表示您确认您已阅读并同意我们的<a href="/cn/legal/serverless-preview-terms" target="_self">服务条款</a>，并且 Elastic 可以使用您提供的上述详细信息与您联系，以向您介绍我们相关的<a href="/cn/legal/privacy-statement#how-we-use-the-information" target="_self">产品和服务</a>。如需了解更多信息，或想随时取消订阅，请参阅 <a href="/cn/legal/privacy-statement/" target="_self">Elastic 的隐私声明</a>。

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

提交即表示您同意 <a href="/cn/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud 服务条款</a>。我们将会按照 <a href="/cn/legal/privacy-statement">Elastic 的隐私声明</a>处理您的个人数据。

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

提交即表示您确认您已阅读并同意我们的<a href="/cn/legal/terms-of-use" target="_self">服务条款</a>，并且 Elastic 可以使用您提供的上述详细信息与您联系，以向您介绍我们相关的<a href="/cn/legal/privacy-statement#how-we-use-the-information" target="_self">产品和服务</a>。如需了解更多信息，或想随时取消订阅，请参阅 <a href="/cn/legal/privacy-statement/" target="_self">Elastic 的隐私声明</a>。

Explore similar demos

Overview

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

本页内容尚不支持所选语言。Elastic 正在不断努力，以实现对多种语言内容的支持。感谢您在此期间给予的耐心与陪伴！

Author

Articles by

Learn more

Watch now (no PT)

Watch now

See all top stories

All (no PT translation)

Contact information

Press Release

Share on Reddit

Share this story

Share by Email

Thank you for your interest!

Contact Info

Follow us on Youtube

Load More

Share on LinkedIn

Follow us on LinkedIn

Search Integrations

All Solutions

Video for

Follow us on Twitter

See when this webinar starts in my time zone

查看本次网络研讨会在我的时区的开始时间

Register to Watch

Register now

See All Posts

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

无法实时参加？注册后我们会给您发送录像。您还将收到相关内容的电子邮件。

Author

Articles by Hyrum Anderson

Machine learning for cybersecurity: only as effective as your implementation

Using deep learning to detect DGAs

Sign up for Elastic Cloud free trial