GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → philarkwright → DGA-Detection

philarkwright / DGA-Detection

Licence: other
DGA Domain Detection using Bigram Frequency Analysis

Programming Languages

python
139335 projects - #7 most used programming language
shell
77523 projects

Labels

malwarebotnet-detectiondgaransomware-detectionwannacrygameoverzeustinbadga-domainsdga-detectiontinba-dga

Projects that are alternatives of or similar to DGA-Detection

The-MALWARE-Repo
A repository full of malware samples.
Stars: ✭ 380 (+708.51%)
Mutual labels:  malware, wannacry
dga-collection
A collection of known Domain Generation Algorithms
Stars: ✭ 61 (+29.79%)
Mutual labels:  malware, dga
mkpoly
A simple polymorphic engine
Stars: ✭ 28 (-40.43%)
Mutual labels:  malware
moneta
Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
Stars: ✭ 384 (+717.02%)
Mutual labels:  malware
kiteshield
Packer/Protector for x86-64 ELF binaries on Linux
Stars: ✭ 71 (+51.06%)
Mutual labels:  malware
unprotect
Unprotect is a python tool for parsing PE malware and extract evasion techniques.
Stars: ✭ 75 (+59.57%)
Mutual labels:  malware
awesome-executable-packing
A curated list of awesome resources related to executable packing
Stars: ✭ 720 (+1431.91%)
Mutual labels:  malware
Owlyshield
Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact))..
Stars: ✭ 281 (+497.87%)
Mutual labels:  malware
Wireguard-DNScrypt-VPN-Server
Fast setup wireguard server script, with dnscrypt and adblocking, maleware blocking, more blocking if you need. Use case eg. always on vpn and adblocking on ios or android, and be more secured in unknown networks.
Stars: ✭ 48 (+2.13%)
Mutual labels:  malware
Malware-Collection
Source codes of malwares, stress tests etc. for computer.
Stars: ✭ 27 (-42.55%)
Mutual labels:  malware
sarlacc
SMTP server / sinkhole for collecting spam
Stars: ✭ 42 (-10.64%)
Mutual labels:  malware
Malware-Zoo
Hashes of infamous malware
Stars: ✭ 18 (-61.7%)
Mutual labels:  malware
binary-auditing-solutions
Learn the fundamentals of Binary Auditing. Know how HLL mapping works, get more inner file understanding than ever.
Stars: ✭ 61 (+29.79%)
Mutual labels:  malware
CEH
Exam Prep for the Ec-council Certified Ethical Hacker 312-50
Stars: ✭ 71 (+51.06%)
Mutual labels:  malware
Orca
Advanced Malware with multifeatures written in ASM/C/C++ , work on all windows versions ! (uncompleted)
Stars: ✭ 184 (+291.49%)
Mutual labels:  malware
flashmingo
Automatic analysis of SWF files based on some heuristics. Extensible via plugins.
Stars: ✭ 117 (+148.94%)
Mutual labels:  malware
Abused-Legitimate-Services
Cloud, CDN, and marketing services leveraged by cybercriminals and APT groups
Stars: ✭ 42 (-10.64%)
Mutual labels:  malware
ioc-fanger
Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .
Stars: ✭ 47 (+0%)
Mutual labels:  malware
vx
Virus Exchange (VX) - Collection of malware or assembly code used for "offensive" purposed.
Stars: ✭ 153 (+225.53%)
Mutual labels:  malware
who and what to follow
Who and what to follow in the world of cyber security
Stars: ✭ 124 (+163.83%)
Mutual labels:  malware
View All Similar Projects ➔

DGA-Detection

More and more malware is being created with advanced blocking circumvention techniques. One of the most prevalent techniques being used is the use of Domain Generation Algorithms which periodically generates a set of Domains to contact a C&C server. The majority of these DGA domains generate random alphanumeric strings which differ significantly in structure to a standard domain. By looking at the frequency that a set of bigrams in a domain occur within the Alexa top 1M, we were able to detect whether a domain was structured with a random string or if it was a legitimate human readable domain. If a domain is comprised nearly entirely of low frequency bigrams which occurred rarely within the Alexa top 1m then the domain would more likely be a random string. Bigrams of a vowel and constants occurred the most frequent whereas characters and integers occurred the least frequent. The script was ran against 100,000 GameoverZeus domains and had a detection rate of 100% and a false positive rate against the Alexa top 1m of 8% without any domain whitelisting being applied.

This System has been tested on Ubuntu and RaspberryPi. Currently I have my raspberrypi setup as a DNS server using Bind9. The DGA-Detection script is also run on the raspberrypi and reads the requests. The requests are then processed to determine if they are a potential DGA or not.

Install

git clone https://github.com/philarkwright/DGA-Detection.git  
cd DGA-Detection  
chmod +x install.sh
./install.sh

Use

sudo python dga_detection.py

Training

  • The /data/dga_training.txt file contains DGA domains from the Tinba DGA. I'd suggest using this to train the model as this follows the structure of the majority of the DGA's domains however you may replace the domains with your own set if you wish too.

Testing

  • To test domains against the model after training has been complete, create a textfile called test_domains.txt and place it into /data/. -A sample of the Tinba DGA domains has been included in the download.

Settings File

  • The settings file is where the model stores the baseline value used to decide whether or not a domain is a potential DGA. This value can be manually changed to increase detection rate or reduced to decrease false positives.

Live Capture Arguments

nohup sudo python dga-detection.py -o 2 -i <interface>

Potential Issues

When running the install.sh file please note that the git:// protocol uses port 9418, so you should make sure your firewall allows outbound connections to this port.

This project is still very much in development.

While running the script at network level on my home network I noticed that if I did certain google searches on google chrome, that I'd get a bunch of alerts which appeared to be DGA domains. Even if you don't visit these sites which are normally chinese (Since they use giberish strings for their domains), google chrome will preload and fetch them causing the alerts.

NOTE: Whitelist features uses the Alexa Top 1m.

Contact me via Twitter @philarkwright

Completed

  • Add Alexa Whitelisting
  • Add Pushbullet (Notify admin)
  • Fix Lag on capture traffic alerts
  • Add arguments so capture live can be ran with nohup
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].