admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

minor change in the detection

Browse Source
This commit is contained in:
Namratha Sreekanta
2022-09-22 14:57:42 -07:00
parent 6678a4ee55
commit d22e6db5ef
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml
+1 -1
View File
@@ -8,7 +8,7 @@ datamodel:
- Network_Resolution
description: 'The following analytic uses a pretrained deep learning model to detect Domain Generation Algorithm (DGA) generated domains. The model is trained independently and then made available in AWS S3. One of the prominent indicators of a domain being DGA generated is if the domain name consists of unusual character sequences or concatenated dictionary words. Adversaries often use clever techniques to obfuscate machine generated domain names as human generated. Predicting DGA generated domain names requires analysis and building a model based on carefully chosen features. The deep learning model we have developed uses the domain name to anlayze patterns of character sequences along with carefully chosen custom features to predict if a domain is DGA generated. The model takes a domain name consisting of second-level and top-level domain names as input and outputs a dga_score. Higher the dga_score, the more likely the input domain is a DGA domain. The threshold for flagging a domain as DGA is set at 0.5.'
search: '| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution by DNS.src, DNS.query
| `drop_dm_object_name("DNS")` | rename query AS domain | fields IPs, src, domain, firstTime, lastTime, src | apply dga_model_dltk | rename pred_dga_proba AS dga_score | where dga_score<0.5 | table src, domain, IPs, firstTime, lastTime,dga_score | `detect_dga_domains_using_pretrained_model_in_dsdl_filter`'
| `drop_dm_object_name("DNS")` | rename query AS domain | fields IPs, src, domain, firstTime, lastTime, src | apply dga_model_dltk | rename pred_dga_proba AS dga_score | where dga_score>0.5 | table src, domain, IPs, firstTime, lastTime,dga_score | `detect_dga_domains_using_pretrained_model_in_dsdl_filter`'
how_to_implement: This detection depends on the DSDL app which can be found here - https://splunkbase.splunk.com/app/4607/ and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. The dga_score threshold is set at 0.5 and this should be adjusted based on the environment. The detection uses a pre-trained deep learning model that needs to be deployed in DSDL. Steps for deployment are outlined here - https://github.com/splunk/security_content/notebooks/dga_dsdl/README.md.
known_false_positives: False positives may be present if domain name is similar to dga generated domains.
references: