admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

DGA Performance fix

Browse Source
This commit is contained in:
Namratha Sreekanta
2023-09-25 12:55:51 -07:00
parent 3a6638dbdd
commit 3743f161a8
1 changed files with 9 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
notebooks/pretrained_dga_model_dsdl.ipynb
+9 -10
View File
@@ -25,7 +25,7 @@
"cell_type": "markdown",
"metadata": {},
"source": [
"Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for Command And Control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the Command And Control channel, as there potentially could be thousands of domains that malware can check for instructions.\n",
"Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.\n",
"\n",
"DGAs can take the form of apparently random or \"gibberish\" strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders https://attack.mitre.org/techniques/T1568/002/"
]
@@ -40,7 +40,7 @@
},
{
"cell_type": "code",
"execution_count": null,
"execution_count": 32,
"metadata": {
"deletable": false,
"name": "mltkc_import"
@@ -228,8 +228,7 @@
"\n",
" \n",
"def is_in_alexa1m(domain,domains):\n",
" test_in_alexa_domains = set(alexa_domains) & domains\n",
" return ((domain in test_in_alexa_domains))\n",
" return ((domain in domains))\n",
"\n",
" \n",
" \n",
@@ -241,13 +240,13 @@
" print (\"2. Done adding entropy\")\n",
" X_4 = df['domain'].map(lambda x: len(x))\n",
" print (\"3. Done adding length of domain\")\n",
" domains = set(df['domain'])\n",
" X_5 = df['domain'].map(lambda x: is_in_alexa1m(x,domains))\n",
" in_alexa = set(alexa_domains) & set(df['domain'])\n",
" X_5 = df['domain'].map(lambda x: is_in_alexa1m(x, in_alexa))\n",
" print (\"4. Done adding domain present in alexa domains\")\n",
" X_5 = X_5.astype(int)\n",
" input2 = np.c_[X_1,X_2,X_3,X_4,X_5] #\n",
" print (\"appending done\")\n",
" return input2 \n",
" return input2\n",
"\n",
"def prep_text(texts):\n",
" text_sequences = tokenizer.texts_to_sequences(texts)\n",
@@ -309,7 +308,7 @@
},
{
"cell_type": "code",
"execution_count": null,
"execution_count": 3,
"metadata": {
"deletable": false,
"name": "mltkc_load"
@@ -369,7 +368,7 @@
],
"metadata": {
"kernelspec": {
"display_name": "Python 3",
"display_name": "Python 3 (ipykernel)",
"language": "python",
"name": "python3"
},
@@ -383,7 +382,7 @@
"name": "python",
"nbconvert_exporter": "python",
"pygments_lexer": "ipython3",
"version": "3.8.5"
"version": "3.9.13"
}
},
"nbformat": 4,