Top

Cluster Computing

Published in:

02-01-2021

Early DGA-based botnet identification: pushing detection to the edges

Authors: Mattia Zago, Manuel Gil Pérez, Gregorio Martínez Pérez

Published in: Cluster Computing | Issue 3/2021

Activate our intelligent search to find suitable subject content or patents.

search-config

AI-assisted search

Off

Abstract

With the first commercially available 5G infrastructures, worldwide’s attention is shifting to the next generation of theorised technologies that might be finally deployable. In this context, the cybersecurity of edge equipment and end-devices must be a top priority as botnets see their spread remarkably increase. Most of them rely on algorithmically generated domain names (AGDs) to evade detection and remain shrouded from intrusion detection systems, via the so-called Domain Generation Algorithm (DGA). Despite the issue, by applying concepts such as distributed computing and federated learning, the cybersecurity community has prototyped and developed dynamic and scalable solutions that leverage the increased capabilities and connectivity of edge devices. This article proposes a lightweight and privacy-preserving framework that pushes the intelligence modules to the edges aiming to achieve early DGA-based botnet detection in mobile and edge-oriented scenarios. Experimental results prove the deployability of such architecture at all levels, including resource-constrained end-devices.

previous article Smart contract based policies for the Internet of Things

next article A divide and conquer approach to deadline constrained cost-optimization workflow scheduling for the cloud

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Afolabi, I., Taleb, T., Samdanis, K., Ksentini, A., Flinck, H.: Network slicing and softwarization: a survey on principles, enabling technologies, and solutions. IEEE Commun. Surv. Tutor. 20(3), 2429–2453 (2018). https://doi.org/10.1109/COMST.2018.2815638CrossRef

Ahmad, I., Shahabuddin, S., Kumar, T., Okwuibe, J., Gurtov, A., Ylianttila, M.: Security for 5G and beyond. IEEE Commun. Surv. Tutor. 21(4), 3682–3722 (2019). https://doi.org/10.1109/COMST.2019.2916180CrossRef

Almashhadani, A.O., Kaiiali, M., Carlin, D., Sezer, S.: MaldomDetector: a system for detecting algorithmically generated domain names with machine learning. Comput. Secur. 93, 101787 (2020). https://doi.org/10.1016/j.cose.2020.101787CrossRef

5G Americas: 5G at the edge. Tech. rep., 5G Americas (2019). Online: https://www.5gamericas.org/wp-content/uploads/2019/10/5G-Americas-EDGE-White-Paper-FINAL.pdf. Accessed 24 Nov 2020

Andrews, J.G., Buzzi, S., Choi, W., Hanly, S.V., Lozano, A., Soong, A.C.K., Zhang, J.C.: What will 5G be? IEEE J. Sel. Areas Commun. 32(6), 1065–1082 (2014). https://doi.org/10.1109/JSAC.2014.2328098CrossRef

5G PPP Architecture Working Group: View on 5G architecture. Tech. rep., 5G Infrastructure Public Private Partnership (2020). https://doi.org/10.5281/zenodo.3265031

Barakabitze, A.A., Ahmad, A., Mijumbi, R., Hines, A.: 5G network slicing using SDN and NFV: a survey of taxonomy, architectures and future challenges. Comput. Netw. 167, 106984 (2020). https://doi.org/10.1016/j.comnet.2019.106984CrossRef

Blaise, A., Bouet, M., Conan, V., Secci, S.: Detection of zero-day attacks: an unsupervised port-based approach. Comput. Netw. 180(January), 107391 (2020). https://doi.org/10.1016/j.comnet.2020.107391CrossRef

Chadwick, D.W., Fan, W., Costantino, G., de Lemos, R., Di Cerbo, F., Herwono, I., Manea, M., Mori, P., Sajjad, A., Wang, X.S.: A cloud-edge based data security architecture for sharing and analysing cyber threat information. Future Gener. Comput. Syst. 102, 710–722 (2020). https://doi.org/10.1016/j.future.2019.06.026CrossRef

10.

Chirivella-Perez, E., Marco-Alaez, R., Hita, A., Serrano, A., Alcaraz Calero, J.M., Wang, Q., Neves, P.M., Bernini, G., Koutsopoulos, K., Gil Pérez, M., Martínez Pérez, G., Barros, M.J., Gavras, A.: SELFNET 5G mobile edge computing infrastructure: design and prototyping. Software 50(5), 741–756 (2020). https://doi.org/10.1002/spe.2681CrossRef

11.

Coppolino, L., D’Antonio, S., Mazzeo, G., Romano, L.: A comprehensive survey of hardware-assisted security: from the edge to the cloud. Internet Things 6, 100055 (2019). https://doi.org/10.1016/j.iot.2019.100055CrossRef

12.

Deng, S., Zhao, H., Fang, W., Yin, J., Dustdar, S., Zomaya, A.Y.: Edge intelligence: the confluence of edge computing and artificial intelligence. IEEE Internet Things J. (2020). https://doi.org/10.1109/jiot.2020.2984887CrossRef

13.

Dhar, S., Guo, J., Liu, J., Tripathi, S., Kurup, U., Shah, M.: On-device machine learning: an algorithms and learning theory perspective (2019). http://arxiv.org/abs/1911.00623

14.

Eskandari, M., Janjua, Z.H., Vecchio, M., Antonelli, F.: Passban IDS: an intelligent anomaly based intrusion detection system for IoT edge devices. IEEE Internet of Things J. (2020). https://doi.org/10.1109/JIOT.2020.2970501CrossRef

15.

Fernández Maimó, L., Perales Gómez, Á.L., García Clemente, F.J., Gil Pérez, M., Martínez Pérez, G.: A self-adaptive deep learning-based system for anomaly detection in 5G networks. IEEE Access 6, 7700–7712 (2018). https://doi.org/10.1109/ACCESS.2018.2803446CrossRef

16.

Hard, A., Kiddon, C.M., Ramage, D., Beaufays, F., Eichner, H., Rao, K., Mathews, R., Augenstein, S.: Federated learning for mobile keyboard prediction (2018). http://arxiv.org/abs/1811.03604

17.

Huertas Celdrán, A., Gil Pérez, M., García Clemente, F.J., Martínez Pérez, G.: Towards the autonomous provision of self-protection capabilities in 5G networks. J. Ambient Intell. Hum. Comput. 10(12), 4707–4720 (2019). https://doi.org/10.1007/s12652-018-0848-6CrossRef

18.

Isakov, M., Gadepally, V., Gettings, K.M., Kinsy, M.A.: Survey of attacks and defenses on edge-deployed neural networks. In: 2019 IEEE High Performance Extreme Computing Conference, pp. 1–8 (2019). https://doi.org/10.1109/HPEC.2019.8916519

19.

Khan, W.Z., Ahmed, E., Hakak, S., Yaqoob, I., Ahmed, A.: Edge computing: a survey. Future Gener. Comput. Syst. 97, 219–235 (2019). https://doi.org/10.1016/j.future.2019.02.050CrossRef

20.

Kumar, R., Goyal, R.: On cloud security requirements, threats, vulnerabilities and countermeasures: a survey. Comput. Sci. Rev. 33, 1–48 (2019). https://doi.org/10.1016/j.cosrev.2019.05.002MathSciNetCrossRef

21.

Laurenza, G., Lazzeretti, R., Mazzotti, L.: Malware triage for early identification of advanced persistent threat activities. Digital Threats 1(3), 1–17 (2020). https://doi.org/10.1145/3386581CrossRef

22.

Lim, W.Y.B., Luong, N.C., Hoang, D.T., Jiao, Y., Liang, Y., Yang, Q., Niyato, D., Miao, C.: Federated learning in mobile edge networks: a comprehensive survey. IEEE Commun. Surv. Tutor. (2020). https://doi.org/10.1109/COMST.2020.2986024CrossRef

23.

Liu, D., Yan, Z., Ding, W., Atiquzzaman, M.: A survey on secure data analytics in edge computing. IEEE Internet Things J. 6(3), 4946–4967 (2019). https://doi.org/10.1109/JIOT.2019.2897619CrossRef

24.

Papamartzivanos, D., Gomez Marmol, F., Kambourakis, G.: Introducing deep learning self-adaptive misuse network intrusion detection systems. IEEE Access 7, 13546–13560 (2019). https://doi.org/10.1109/ACCESS.2019.2893871CrossRef

25.

Pham, Q.V., Fang, F., Ha, V.N., Piran, M.J., Le, M., Le, L.B., Hwang, W.J., Ding, Z.: A survey of multi-access edge computing in 5G and beyond: fundamentals, technology integration, and state-of-the-art. IEEE Access 8, 116974–117017 (2020). https://doi.org/10.1109/ACCESS.2020.3001277CrossRef

26.

Ren, J., Zhang, D., He, S., Zhang, Y., Li, T.: A survey on end-edge-cloud orchestrated network computing paradigms: transparent computing, mobile edge computing, fog computing, and cloudlet. ACM Comput. Surv. 52(6), 125 (2019). https://doi.org/10.1145/3362031CrossRef

27.

Sharma, R., Chan, C.A., Leckie, C.: Evaluation of centralised vs distributed collaborative intrusion detection systems in multi-access edge computing. In: 2020 IFIP Networking Conference (Networking), pp. 343–351 (2020)

28.

Shi, W.C., Sun, H.M.: DeepBot: a time-based botnet detection with deep learning. Soft Comput. (2020). https://doi.org/10.1007/s00500-020-04963-zCrossRef

29.

Sun, P.J.: Privacy protection and data security in cloud computing: a survey, challenges, and solutions. IEEE Access 7, 147420–147452 (2019). https://doi.org/10.1109/ACCESS.2019.2946185CrossRef

30.

Tabassi, E., Burns, K.J., Hadjimichael, M., Molina-Markham, A.D., Sexton, J.T.: A taxonomy and terminology of adversarial machine learning—DRAFT. Tech. rep., NIST (2019). https://doi.org/10.6028/NIST.IR.8269-draft

31.

Tian, J., Gou, G., Liu, C., Chen, Y., Xiong, G., Li, Z.: DLchain: A covert channel over blockchain based on dynamic labels. In: Information and Communications Security, pp. 814–830 (2020). https://doi.org/10.1007/978-3-030-41579-2_47

32.

Wang, X., Han, Y., Wang, C., Zhao, Q., Chen, X., Chen, M.: In-edge AI: intelligentizing mobile edge computing, caching and communication by federated learning. IEEE Netw. 33(5), 156–165 (2019). https://doi.org/10.1109/MNET.2019.1800286CrossRef

33.

Wang, X., Han, Y., Leung, V.C., Niyato, D., Yan, X., Chen, X.: Convergence of edge computing and deep learning: a comprehensive survey. IEEE Commun. Surv. Tutor. (2020). https://doi.org/10.1109/comst.2020.2970550CrossRef

34.

Xu, X., Liu, X., Yin, X., Wang, S., Qi, Q., Qi, L.: Privacy-aware offloading for training tasks of generative adversarial network in edge computing. Inf. Sci. 532, 1–15 (2020). https://doi.org/10.1016/j.ins.2020.04.026MathSciNetCrossRef

35.

Yao, H., Gao, P., Zhang, P., Wang, J., Jiang, C., Lu, L.: Hybrid intrusion detection system for edge-based IIoT relying on machine-learning-aided detection. IEEE Netw. 33(5), 75–81 (2019). https://doi.org/10.1109/MNET.001.1800479CrossRef

36.

Yun, X., Huang, J., Wang, Y., Zang, T., Zhou, Y., Zhang, Y.: Khaos: an adversarial neural network DGA with high anti-detection ability. IEEE Trans. Inf. Forensics Secur. 15, 2225–2240 (2020). https://doi.org/10.1109/TIFS.2019.2960647CrossRef

37.

Zago, M., Gil Pérez, M., Martínez Pérez, G.: Scalable detection of botnets based on DGA: efficient feature discovery process in machine learning techniques. Soft Comput. 24, 5517–5537 (2020). https://doi.org/10.1007/s00500-018-03703-8CrossRef

38.

Zago, M., Gil Pérez, M., Martínez Pérez, G.: UMUDGA: a dataset for profiling algorithmically generated domain names in botnet detection. Data Brief 30, 105400 (2020). https://doi.org/10.1016/j.dib.2020.105400CrossRef

39.

Zago, M., Gil Pérez, M., Martínez Pérez, G.: UMUDGA: a dataset for profiling DGA-based botnet. Comput. Secur. 92, 101719 (2020). https://doi.org/10.1016/j.cose.2020.101719CrossRef

40.

Zargar, S.T., Takabi, H., Iyer, J.: Security-as-a-Service (SECaaS) in the cloud. Security, Privacy, and Digital Forensics in the Cloud, Chap. 9, pp. 189–200. Wiley, New York (2019). https://doi.org/10.1002/9781119053385CrossRef

41.

Zhang, Y., Huang, H., Yang, L.X., Xiang, Y., Li, M.: Serious challenges and potential solutions for the industrial internet of things with edge intelligence. IEEE Netw. 33(5), 41–45 (2019). https://doi.org/10.1109/MNET.001.1800478CrossRef

42.

Zhang, C., Ueng, Y., Studer, C., Burg, A.: Artificial intelligence for 5G and beyond 5G: implementations, algorithms, and optimizations. IEEE J. Emerg. Sel. Topics Circ. Sys. 10(2), 149–163 (2020). https://doi.org/10.1109/JETCAS.2020.3000103CrossRef

43.

Zhou, Z., Chen, X., Li, E., Zeng, L., Luo, K., Zhang, J.: Edge intelligence: paving the last mile of artificial intelligence with edge computing. Proc. IEEE 107(8), 1738–1762 (2019). https://doi.org/10.1109/JPROC.2019.2918951CrossRef

Title: Early DGA-based botnet identification: pushing detection to the edges
Authors: Mattia Zago
Manuel Gil Pérez
Gregorio Martínez Pérez
Publication date: 02-01-2021
Publisher: Springer US
Published in: Cluster Computing / Issue 3/2021
Print ISSN: 1386-7857
Electronic ISSN: 1573-7543
DOI: https://doi.org/10.1007/s10586-020-03213-z

Springer Professional

Abstract

Please log in to get access to your license.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"

Other articles of this Issue 3/2021

Building an efficient intrusion detection system using grasshopper optimization algorithm for anomaly detection

Data replication schemes in cloud computing: a survey

Virtual network function placement with bounded migrations

A divide and conquer approach to deadline constrained cost-optimization workflow scheduling for the cloud

Real time UAV path planning by parallel grey wolf optimization with align coefficient on CAN bus

Distributed anomaly detection using concept drift detection based hybrid ensemble techniques in streamed network data

Premium Partner