Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic
Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.
Unit 42 built an RNN-based autoencoder that compresses DNS traffic time series into fixed-dimensional 'DNS profiles' for each domain and device. Downstream classification, clustering, and anomaly detection modules flag suspicious domains, capturing 170 emerging suspicious domains in May 2024. Signatures block roughly 374,000 malicious DNS requests daily and run in the Advanced DNS Security service, with detections shared to Advanced URL Filtering. Case studies link DNS traffic patterns to C2 beaconing, dynamic DNS abuse, and DNS tunneling for data exfiltration.
- RNN autoencoder compresses per-domain DNS time series into fixed-size DNS profiles
- Classification model trained on benign and malicious profiles flags domains in real time
- Clustering of profiles reveals groups like DDNS abuse and DNS tunneling
- Detector captured 170 suspicious domains in May 2024, blocking ~374,000 DNS requests daily
- Detections feed Advanced DNS Security and Advanced URL Filtering
- Products
- Advanced DNS Security
- Organizations
- Palo Alto NetworksUnit 42
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | biillpi.com | avior patterns. Our detector identified one such C2 domain, biillpi[.]com. Figure 4 shows the DNS request trends for this domain. W |
| domain | carollewis.network | e malicious DNS traffic detector. One example is the domain carollewis[.]network . Figure 8 shows that DNS traffic for this scam activity |
| domain | comcadt.net | captures traffic toward squatting domains . One example is comcadt[.]net , which is a typosquatting domain mimicking a popular tel |
| domain | networkcyclechain.com | cious landing pages. An example URL is cqk1rt8hubcc73f3775g.networkcyclechain[.]com/01 , which was a fake antivirus page when we checked it i |
| domain | pococo.cc | limited amount of heartbeat traffic to the malicious domain pococo[.]cc but not in a uniform manner, over the course of one day. |
| domain | robotatten.com | presents the DNS requests to a malicious Trojan’s C2 domain robotatten[.]com , hosted by nameservers from the DDNS provider ztomy[.]co |
| domain | run.sh | Figure 3 illustrates the DNS requests trend for the domain run[.]sh from a specific device that presents abnormal time series |
| domain | ztomy.com | tatten[.]com , hosted by nameservers from the DDNS provider ztomy[.]com . The DDNS service resolves this domain to many IP addres |
From the original article
11 min read at unit42.paloaltonetworks.com
To improve our detection of suspicious network activity, we leveraged a deep learning method to profile and detect malicious DNS traffic patterns. Based on these DNS profiles, we developed multiple detection modules, each designed to identify suspicious domains from different perspectives.
By Reethika Ramesh, Daiping Liu, Zhanhao Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.