Cyber Defense eMagazine August Edition for 2021

It’s not quite that straightforward when we’re dealing with Command-and-Control traffic analysis. But
looking at multiple aspects of network transactions with some rich context can deliver effective detection.
Here at Zscaler, we examine network transaction domain details, including hostname, associated IP
address, full URL string, user-agent string, and many more.
We extract the features based on spatial-temporal correlation over time among the network transaction
domain hosts/users/companies. (In Machine Learning parlance, the “feature” is the useful and informative
data “extracted” from the original network data transactions.) In this way, feature engineering is done by
correlating the network events across time (temporal) and across the hosts, users, and companies
(spatial).
For example, a botnet-infected host might trigger several different DNS requests to ping for a C2 server
before establishing communication with it. In some cases, that behavior might appear normal if compared
to a baseline associated with that particular host, but unusual if compared to the baseline established
from a larger population of hosts.
After the features are obtained, we then train a tree-based machine learning model for each aspect (e.g.,
hostname-based transaction patterns, IP-based transaction patterns, URL, user-agent, etc.) and
combine them together to produce a final prediction. (See Figure 1.)
Why not stack all the features together into a single predictive model? First, empirical evidence suggests
that the “ensemble-type” architecture achieves higher accuracy. Second, the ensemble approach helps
with the prediction’s “explainability”: When the model makes a positive prediction regarding a particular
transaction related to a particular domain, we can assess each individual component score output by
submodel and understand the logic behind the prediction.
Table 1 below shows the example of a positive prediction by the Zscaler model and its corresponding
scores output by each of the submodels. The scores are in the range from 0 to 1, where the higher value
indicates the more suspicious. In this particular case, the model called out the domain
c8dd8ae6dc4dc644[.]xyz because the URL looks very suspicious -- the URL score is very high -- which
somewhat matches with the human impression.
Domain
Hostnamebased
pattern
URL score
score
IP-based
pattern score
User-agent
score
c8dd8ae6dc4dc644[.]xyz 0.36898 0.99981 0.74281 0.088025
Table 1: A positive predicted domain with associated submodel scores
Cyber Defense eMagazine – August 2021 Edition 134
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.