Probabilistic detection of malware infected hosts via DNS query analysis.

No ratings

Presented at NolaCOn 2014 by

Brandon Niemczyk

A large amount of DNS traffic was collected from a US based network in an attempt to determine if botnet infected hosts could be identified based solely on the captured traffic. In the absence of ground truth we wanted our classifier to be human-interpretable and planned to verify the results logically and statistically. As a result we avoided techniques like multi-layer artificial neural networks. Our approach is to label a candidate data set that will show differences in probability distributions between the classes PROBABLY_INFECTED and UNKNOWN and then to identify individual infected hosts using Bayesian analysis. This talk will cover building a dataset with candidate labels, creating a classifier, and then running the classifier against the collected DNS data.