TCPWave DDI - XGBoost Model

Introduction

DNS is a central part of internet operations. The primary use of the DNS is to translate IP addresses to human-friendly names; this makes it a critical component of business operations. As a result, it has become the main target for malicious actors. The malicious actors have successfully deployed various DNS-based attacks, such as the application of Domain Generation Algorithms (DGA) to command and control a group of Internet of Things (IoT) or tunneling techniques. Despite the continuous progress in detecting DNS attacks, there are still weak spots in the network security infrastructure. Hence, it is imperative to implement new ways to analyze data, particularly machine learning (ML) algorithms. Various security teams urge to integrate ML-based DGA detection within the organizations that provide high-performance accuracy based on the data. TCPWave's DNS TITAN solution provides to combat and safeguards the DNS from the attacks. It uses In-House built tunnel detection Machine Learning (ML) algorithms trained using massive ~3.3M records and varied DNS data, thereby learning and detecting the malicious DNS traffic flowing through the DNS pathways in the enterprises. This white paper provides insights on how TCPWave's Threat Intelligence uses one of the ML models - XGBoost to detect and mitigate the DNS anomalies.

Machine Learning

It is one of the subsets of Artificial Intelligence (AI). It finishes the task of learning from data with specific inputs to the machine.

There are several stages in the ML lifecycle, and a few of the major ones are:

Data Management

Dataset is one of the main components in building an ML model.

Feature Engineering

It is the process of extracting the features from the raw data to capture the data properties and give them as input to the ML model. TCPWave's ML Engineering team has obtained some features, such as metric entropy, symbols ratio, etc. The features are further filtered by conducting multicollinearity checks; below is the plot of the features. Click here to know about the feature selection.

Model Training

TCPWave's ML Engineering team used the above data management and feature engineering steps to train and evaluate an XGBoost model.

About XGBoost

To improve the ML model's accuracy, the TCPWave's ML Engineering team has used the RandomizedSearchCV - one of the best hyperparameter tuning methods. In this strategy, each iteration tries a random combination of hyperparameters. It records the performance and returns the combination of the following hyperparameters that gives the best performance:

Model Evaluation

Based on the best hyperparameter combination, the XGBoost's innovative features and algorithmic optimizations rendered an accuracy close to the Atlantis model.

Note: Atlantis is a hybrid model whose deep learning architecture is designed using Convolution Neural Networks (CNN) layer and a Long- and Short-Term Memory (LSTM) layer in parallel.

Configuring XGBoost Model in TCPWave IPAM

XGBoost Model is categorized as an ML model for anomaly detection in TCPWave IPAM. To configure it:

1. Create a Network Security Monitoring (NSM) Template, and enable the Anomaly Detection option.
2. Associate the NSM Template with one or more DNS appliances. An NSM Templates can be associated with the following types of appliances:
   • ISC BIND Authoritative appliances with recursion enabled
   • ISC BIND Cache appliances
   • Unbound Cache appliances

   Also, an NSM Template can only be associated with an appliance in the same Organization as the Template.

Detailed information on these two configuration steps is provided in the subsections below.

Create an NSM Template

1. Go to Network Management > DNS Management > DNS Security > DNS Threat Management.
2. Select the NSM Templates tab, and then Add .
3. On the NSM Configuration tab, enter values as needed, including the following:
   1. Select the organization from the drop-down.
   2. Enter the Template Name.
   3. Enter the Network Interface name, such as eth0.
   4. Enable Anomaly Detection. The system displays the following Machine Learning models drop-down:
      1. Atlantis
      2. XGBoost
      
   5. Select XGBoost model.
   6. (Optional) Select Enable Intrusion Prevention.
   7. (Optional) Enter Rule Variables for source and destination IP addresses and ports used in rules.
   8. Select OK.

Associate an NSM Template with a DNS Appliance

Anomaly Detection Service

Conclusion

The never-ending battle persists with the complexity of the threats changing as quickly as innovation grows. Many organizations are working hard to overcome DNS anomalies by introducing new configurations or developing in-house ML models. Hence, the organizations look forward to having a framework that ensures all the facets of the security ecosystem are safe and secure. TCPWave's XGBoost model is one of the best solutions to detect and mitigate DNS anomalies. For a demo, contact the TCPWave Sales Team.

Appendix

FANCI: TCPWave's ML Engineering team obtained some of the features using this system.