论文标题
莫顿：大规模DNS交通中的恶意例程检测
MORTON: Detection of Malicious Routines in Large-Scale DNS Traffic
论文作者
论文摘要
在本文中，我们介绍了Morton，该方法是根据设备之间的常规DNS通信和不可授权的主机名中的常规DNS通信来识别企业网络中的折衷设备。莫顿（Morton）凭借其紧凑的输入数据和有效信号处理的使用以及用于分类的神经网络的使用，其设计为准确，健壮且可扩展。我们使用大量公司DNS日志数据集评估莫顿，并将其与旨在检测恶意软件通信的两种最近提出的灯塔检测方法进行比较。结果表明，尽管莫顿在合成实验中的准确性与其他方法的准确性相当，但它在检测复杂的机器人通信技术（例如多阶段渠道）以及其稳健性和效率方面的能力表现优于这些方法。在现实世界中的评估中，其中包括以前未报告的威胁，莫顿和两种比较方法被部署了，以监视一个为期一周的全球两家全球企业的（未标记的）DNS流量；该评估证明了Morton在现实世界中的有效性，并在真实和假阳性率方面展示了其优越性。
In this paper, we present MORTON, a method that identifies compromised devices in enterprise networks based on the existence of routine DNS communication between devices and disreputable host names. With its compact representation of the input data and use of efficient signal processing and a neural network for classification, MORTON is designed to be accurate, robust, and scalable. We evaluate MORTON using a large dataset of corporate DNS logs and compare it with two recently proposed beaconing detection methods aimed at detecting malware communication. The results demonstrate that while MORTON's accuracy in a synthetic experiment is comparable to that of the other methods, it outperforms those methods in terms of its ability to detect sophisticated bot communication techniques, such as multistage channels, as well as in its robustness and efficiency. In a real-world evaluation, which includes previously unreported threats, MORTON and the two compared methods were deployed to monitor the (unlabeled) DNS traffic of two global enterprises for a week-long period; this evaluation demonstrates the effectiveness of MORTON in real-world scenarios and showcases its superiority in terms of true and false positive rates.
