Cyber Defense eMagazine August Edition for 2021

Hostname-based
pattern model
Traffic
data
IP-based pattern
model
URL model
Ensemble model
User-agent
model
Figure 1. Machine learning model architecture for C2 activity detection
Human-in-the-loop and lab testing
Machine Learning is good at spotting suspicious C2 activity based on transaction data. Yet human review
can still be necessary to identify and confidently call out malicious C2 activity. At issue: It’s not feasible
for human experts to review billions (or even, if the data is filtered, millions) of transactions per day.
Instead, Zscaler employs a two-phase approach: The Machine Learning model outputs a shortlist of “high
confidence” suspicious C2 domains based on transactions from within a specific time window, effectively
filtering the transactions down to a manageable size for phase-two human review (and subsequent
action). In the example above, “c8dd8ae6dc4dc644[.]xyz” was confirmed as a malicious C2 domain by
security researchers.
Detecting the unknown: a process of continuous improvement
Machine Learning can detect and block unknown botnets via analysis of command-and-control channels.
Zscaler leverages unsupervised learning techniques to shortlist suspicious domains for deeper analysis,
and then uses supervised learning methods to detect botnet command-and-control channels with high
confidence. Every day, the Zscaler Zero Trust Exchange blocks botnets that have never been seen
before.
Cyber Defense eMagazine – August 2021 Edition 135
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.