From 56aea9de227f97074f322b9bbbad179b013befbb Mon Sep 17 00:00:00 2001 From: Namratha Sreekanta Date: Tue, 20 Sep 2022 12:28:53 -0700 Subject: [PATCH] Adding in Sharad's inputs on descriptioj --- .../experimental/network/detect_dga_domains_using_dltk.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/experimental/network/detect_dga_domains_using_dltk.yml b/detections/experimental/network/detect_dga_domains_using_dltk.yml index b65a51b973..9528b8dd10 100644 --- a/detections/experimental/network/detect_dga_domains_using_dltk.yml +++ b/detections/experimental/network/detect_dga_domains_using_dltk.yml @@ -6,7 +6,7 @@ author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk type: Anomaly datamodel: - Network_Resolution -description: 'The following analytic uses a pretrained deep learning classifier to detect DGA domains. The model is trained independently and the model file is available in AWS S3. A domain is classified as DGA generated when the domain name consists of unusual character sequences or concatenated english words. The model uses the domain name to anlayze patterns of character sequences along with custom features to classify a domain as DGA or not. The model takes a domain name consisting of second-level and top-level domain names as input and outputs a dga_score. Higher the dga_score, the more likely the input domain is a dga domain. The threshold for flagging a domain as dga is set at 0.5.' +description: 'The following analytic uses a pretrained deep learning model to detect Domain Generation Algorithm (DGA) generated domains. The model is trained independently and then made available in AWS S3. One of the prominent indicators of a domain being DGA generated is if the domain name consists of unusual character sequences or concatenated dictionary words. Adversaries often use clever techniques to obfuscate machine generated domain names as human generated. Predicting DGA generated domain names requires analysis and building a model based on carefully chosen features. The deep learning model we have developed uses the domain name to anlayze patterns of character sequences along with carefully chosen custom features to predict if a domain is DGA generated. The model takes a domain name consisting of second-level and top-level domain names as input and outputs a dga_score. Higher the dga_score, the more likely the input domain is a DGA domain. The threshold for flagging a domain as DGA is set at 0.5.' search: "| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name("DNS")` | rename query AS domain | fields domain | apply dga_model_dltk | rename pred_dga_proba AS dga_score | where dga_score>0.5 | table domain, dga_score" how_to_implement: This detection depends on the DSDL app which can be found here - https://splunkbase.splunk.com/app/4607/ and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. The dga_score threshold is set at 0.5 and this should be adjusted based on the environment. The detection uses a pre-trained deep learning model that needs to be deployed in DLTK. Steps for deployment are outlined here - ** update gist here **.