The More, the Better? A Study on Collaborative Machine Learning for DGA Detection

Abstract

Domain generation algorithms (DGAs) prevent the connection between a botnet and its master from being blocked by generating a large number of domain names. Promising single-data-source approaches have been proposed for separating benign from DGA-generated domains. Collaborative machine learning (ML) can be used in order to enhance a classifier's detection rate, reduce its false positive rate (FPR), and to improve the classifier's generalization capability to different networks. In this paper, we complement the research area of DGA detection by conducting a comprehensive collaborative learning study, including a total of 13,440 evaluation runs. In two real-world scenarios we evaluate a total of eleven different variations of collaborative learning using three different state-of-the-art classifiers. We show that collaborative ML can lead to a reduction in FPR by up to 51.7%. However, while collaborative ML is beneficial for DGA detection, not all approaches and classifier types profit equally. We round up our comprehensive study with a thorough discussion of the privacy threats implicated by the different collaborative ML approaches.

Accepted at The 3rd Workshop on Cyber-Security Arms Race (CYSARM '21)

References in corpus (25)

• Distilling the Knowledge in a Neural Network
• Deep Learning with Differential Privacy
• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• How To Backdoor Federated Learning
• CNN Features off-the-shelf: an Astounding Baseline for Recognition
• Differentially Private Federated Learning: A Client Level Perspective
• Applied Federated Learning: Improving Google Keyboard Query Suggestions
• Can You Really Backdoor Federated Learning?
• A generic framework for privacy preserving deep learning
• Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning
• Predicting Domain Generation Algorithms with Long Short-Term Memory Networks
• eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys
• From Distributed Machine Learning To Federated Learning: In The View Of Data Privacy And Security
• Data Poisoning Attacks Against Federated Learning Systems
• Analyzing the Real-World Applicability of DGA Classifiers
• Practical and Private (Deep) Learning without Sampling or Shuffling
• Secure Weighted Aggregation for Federated Learning
• Making Use of NXt to Nothing: The Effect of Class Imbalances on DGA Detection Classifiers
• Federated $f$-Differential Privacy
• Clustering Algorithm to Detect Adversaries in Federated Learning
• R-GAP: Recursive Gradient Attack on Privacy
• Constrained Differentially Private Federated Learning for Low-bandwidth Devices
• Simeon -- Secure Federated Machine Learning Through Iterative Filtering
• Sample-based Federated Learning via Mini-batch SSCA