English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

An important aspect of many botnets is their capability to generatepseudorandom domain names using Domain Generation Algorithms (DGAs). A cybercriminal can register such domains to establish periodically changingrendezvous points with the bots. DGAs make use of seeds to generate sets ofdomains. Seeds can easily be changed in order to generate entirely new groupsof domains while using the same underlying algorithm. While this requires verylittle manual effort for an adversary, security specialists typically have tomanually reverse engineer new malware strains to reconstruct the seeds. Onlywhen the seed and DGA are known, past and future domains can be generated,efficiently attributed, blocked, sinkholed or used for a take-down. Commoncounters in the literature consist of databases or Machine Learning (ML) baseddetectors to keep track of past and future domains of known DGAs and toidentify DGA-generated domain names, respectively. However, database basedapproaches can not detect domains generated by new DGAs, and ML approaches cannot generate future domain names. In this paper, we introduce SESAME, a systemthat combines the two above-mentioned approaches and contains a module forautomatic Seed Reconstruction, which is, to our knowledge, the first of itskind. It is used to automatically classify domain names, rate their novelty,and determine the seeds of the underlying DGAs. SESAME consists of multipleDGA-specific Seed Reconstructors and is designed to work purely based on domainnames, as they are easily obtainable from observing the network traffic. Weevaluated our approach on 20.8 gigabytes of DNS-lookups. Thereby, we identified17 DGAs, of which 4 were entirely new to us.

Open SESAME: Fighting Botnets with Seed Reconstructions of Domain Generation Algorithms