Robust Botnet DGA Detection: Blending XAI and OSINT for Cyber Threat Intelligence Sharing

Hatma Suryotrisongko*, Yasuo Musashi, Akio Tsuneda, Kenichi Sugitani

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

15 Citations (Scopus)

Abstract

We investigated 12 years DNS query logs of our campus network and identified phenomena of malicious botnet domain generation algorithm (DGA) traffic. DGA-based botnets are difficult to detect using cyber threat intelligence (CTI) systems based on blocklists. Artificial intelligence (AI)/machine learning (ML)-based CTI systems are required. This study (1) proposed a model to detect DGA-based traffic based on statistical features with datasets comprising 55 DGA families, (2) discussed how CTI can be expanded with computable CTI paradigm, and (3) described how to improve the explainability of the model outputs by blending explainable AI (XAI) and open-source intelligence (OSINT) for trust problems, an antidote for skepticism to the shared models and preventing automation bias. We define the XAI-OSINT blending as aggregations of OSINT for AI/ML model outcome validation. Experimental results show the effectiveness of our models (96.3% accuracy). Our random forest model provides better robustness against three state-of-the-art DGA adversarial attacks (CharBot, DeepDGA, MaskDGA) compared with character-based deep learning models (Endgame, CMU, NYU, MIT). We demonstrate the sharing mechanism and confirm that the XAI-OSINT blending improves trust for CTI sharing as evidence to validate our proposed computable CTI paradigm to assist security analysts in security operations centers using an automated, explainable OSINT approach (for second opinion). Therefore, the computable CTI reduces manual intervention in critical cybersecurity decision-making.

Original languageEnglish
Pages (from-to)34613-34624
Number of pages12
JournalIEEE Access
Volume10
DOIs
Publication statusPublished - 2022

Keywords

  • Adversarial machine learning
  • DGA
  • botnet
  • cybersecurity
  • explainable artificial intelligence
  • threat intelligence

Fingerprint

Dive into the research topics of 'Robust Botnet DGA Detection: Blending XAI and OSINT for Cyber Threat Intelligence Sharing'. Together they form a unique fingerprint.

Cite this