Discovering Suspicious APT Behaviors by Analyzing DNS Activities
As sensors become more prevalent in our lives, security issues have become a major concern. In the Advanced Persistent Threat (APT) attack, the sensor has also become an important role as a transmission medium. As a relatively weak link in the network transmission process, sensor networks often beco...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2020-01-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/20/3/731 |
| _version_ | 1811300231081361408 |
|---|---|
| author | Guanghua Yan Qiang Li Dong Guo Xiangyu Meng |
| author_facet | Guanghua Yan Qiang Li Dong Guo Xiangyu Meng |
| author_sort | Guanghua Yan |
| collection | DOAJ |
| description | As sensors become more prevalent in our lives, security issues have become a major concern. In the Advanced Persistent Threat (APT) attack, the sensor has also become an important role as a transmission medium. As a relatively weak link in the network transmission process, sensor networks often become the target of attackers. Due to the characteristics of low traffic, long attack time, diverse attack methods, and real-time evolution, existing detection methods have not been able to detect them comprehensively. Current research suggests that a suspicious domain name can be obtained by analyzing the domain name resolution (DNS) request to the target network in an APT attack. In past work based on DNS log analyses, most of the work would simply calculate the characteristics of the request message or the characteristics of the response message or the feature set of the request message plus the response message, and the relationship between the response message and the request message was not considered. This may leave out the detection of some APT attacks in which the DNS resolution process is incomplete. This paper proposes a new feature that represents the relationship between a DNS request and the response message, based on a deep learning method used to analyze the DNS request records. The algorithm performs threat assessment on the DNS behavior to be detected based on the calculated suspicious value. This paper uses the data of 4, 907, 147, 146 DNS request records (376, 605, 606 records after DNS Data Pre-processing) collected in a large campus network and uses simulation attack data to verify the validity and correctness of the system. The results of the experiments show that our method achieves an average accuracy of 97.6% in detecting suspicious DNS behavior, with the orange false positive (FP) at 2.3% and the recall at 96.8%. The proposed system can effectively detect the hidden and suspicious DNS behavior in APT. |
| first_indexed | 2024-04-13T06:48:59Z |
| format | Article |
| id | doaj.art-fb587718a1a641d5b97d5c0e50dc5275 |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-04-13T06:48:59Z |
| publishDate | 2020-01-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-fb587718a1a641d5b97d5c0e50dc52752022-12-22T02:57:29ZengMDPI AGSensors1424-82202020-01-0120373110.3390/s20030731s20030731Discovering Suspicious APT Behaviors by Analyzing DNS ActivitiesGuanghua Yan0Qiang Li1Dong Guo2Xiangyu Meng3College of Computer Science and Technology, Jilin University, Changchun 130012, ChinaCollege of Computer Science and Technology, Jilin University, Changchun 130012, ChinaKey Laboratory of Symbol Computation and Knowledge Engineering, Jilin University, Ministry of Education, Changchun 130012, ChinaCollege of Computer Science and Technology, Jilin University, Changchun 130012, ChinaAs sensors become more prevalent in our lives, security issues have become a major concern. In the Advanced Persistent Threat (APT) attack, the sensor has also become an important role as a transmission medium. As a relatively weak link in the network transmission process, sensor networks often become the target of attackers. Due to the characteristics of low traffic, long attack time, diverse attack methods, and real-time evolution, existing detection methods have not been able to detect them comprehensively. Current research suggests that a suspicious domain name can be obtained by analyzing the domain name resolution (DNS) request to the target network in an APT attack. In past work based on DNS log analyses, most of the work would simply calculate the characteristics of the request message or the characteristics of the response message or the feature set of the request message plus the response message, and the relationship between the response message and the request message was not considered. This may leave out the detection of some APT attacks in which the DNS resolution process is incomplete. This paper proposes a new feature that represents the relationship between a DNS request and the response message, based on a deep learning method used to analyze the DNS request records. The algorithm performs threat assessment on the DNS behavior to be detected based on the calculated suspicious value. This paper uses the data of 4, 907, 147, 146 DNS request records (376, 605, 606 records after DNS Data Pre-processing) collected in a large campus network and uses simulation attack data to verify the validity and correctness of the system. The results of the experiments show that our method achieves an average accuracy of 97.6% in detecting suspicious DNS behavior, with the orange false positive (FP) at 2.3% and the recall at 96.8%. The proposed system can effectively detect the hidden and suspicious DNS behavior in APT.https://www.mdpi.com/1424-8220/20/3/731apt attackdnsdeep learningbehavior detectionsensor network |
| spellingShingle | Guanghua Yan Qiang Li Dong Guo Xiangyu Meng Discovering Suspicious APT Behaviors by Analyzing DNS Activities Sensors apt attack dns deep learning behavior detection sensor network |
| title | Discovering Suspicious APT Behaviors by Analyzing DNS Activities |
| title_full | Discovering Suspicious APT Behaviors by Analyzing DNS Activities |
| title_fullStr | Discovering Suspicious APT Behaviors by Analyzing DNS Activities |
| title_full_unstemmed | Discovering Suspicious APT Behaviors by Analyzing DNS Activities |
| title_short | Discovering Suspicious APT Behaviors by Analyzing DNS Activities |
| title_sort | discovering suspicious apt behaviors by analyzing dns activities |
| topic | apt attack dns deep learning behavior detection sensor network |
| url | https://www.mdpi.com/1424-8220/20/3/731 |
| work_keys_str_mv | AT guanghuayan discoveringsuspiciousaptbehaviorsbyanalyzingdnsactivities AT qiangli discoveringsuspiciousaptbehaviorsbyanalyzingdnsactivities AT dongguo discoveringsuspiciousaptbehaviorsbyanalyzingdnsactivities AT xiangyumeng discoveringsuspiciousaptbehaviorsbyanalyzingdnsactivities |