Since 2018 and the release of the first version of Reveelium, the ITrust team has been convinced of the value of artificial intelligence for cybersecurity. In recent years, market trends have proven us right: from small and medium-sized businesses to industry giants, everyone is relying on this technology to dramatically increase their ability to detect threats.
What is AI?
Reveelium is not yet capable of thinking like a human, and therefore cannot replace the expertise of a seasoned SOC analyst. That said, ITrust’s use of AI goes far beyond even optimized IF/THEN rules, which have long been the foundation of this decision-making system—one that is heavily supervised by humans.
Making a decision in a predefined situation is not a sign of intelligence. Traditionally, SIEM correlation rules are static and fixed. They do not adapt to new situations and cannot learn from their mistakes.
However, this concept of learning is crucial for detecting the multitude of new threats facing businesses and for countering the increasingly complex and sophisticated attacks by cybercriminals.
In response to this reality, ITrust’s data scientists have been developing our own machine learning algorithms for several years. Their goal: to continuously improve threat detection by identifying, among thousands of logs, patterns that a human might not necessarily notice.
In a previous post, we discussed the Kryptis malware and how we were able to detect it using the three-pronged approach: SIEM, UEBA, and Threat Intelligence.
Today, we’d like to take a closer look at the UEBA engine behind our Reveelium technology by introducing one of its algorithms: DGA. Without going into the precise details of how it works, we’ll simply explain the temporal and syntactic analysis methods that make this algorithm valuable for malware detection.
Reminder about the Kryptis malware:
This is a Trojan malware program that, once installed, can be controlled remotely by the attacker (Command & Control). It is used to steal information such as usernames, passwords, or sensitive files (exfiltration). It can also take screenshots, record keystrokes (keylogging), monitor network traffic, launch executable files… and send all this information to a remote server controlled by an attacker.
The Deputy Director General:
During this cyberattack, our DGA detection algorithm enabled us to detect the spread of the Kryptis malware by correlating one of our alerts with alerts from the SIEM.
But what is a DGA?
The DGA (Domain Generation Algorithm) is a technique used by cyberattackers to generate new domain names for malware command-and-control servers. Detecting these domains is crucial, as it can enable the early detection of certain known or unknown malware.
What does AI bring to the table?
An interesting question to ask is: How does AI contribute to the detection of DGA? The answer is simple: AI enables a more in-depth analysis of domain names. It allows for both semantic and syntactic analysis of domain names, thereby enabling more accurate—and thus more effective—classification.
Semantic analysis:
Semantic analysis is the process used to assess the pronounceability of a domain name. In other words, it determines whether the domain name under consideration is pronounceable or not. But more importantly, it determines how pronounceable it is.
To perform this semantic analysis, the most commonly used algorithms are deep learning algorithms, specifically RNNs (Recurrent Neural Networks). RNNs are deep learning algorithms (neural networks) that perform a temporal analysis of the data (recurrent). The great strength of this type of algorithm is that it allows us to observe the recurring appearance of certain patterns.
It is used in DGA detection as follows: when examining certain words (in French or English) or domain names, patterns emerge, such as the alternation between consonants and vowels.
Observing patterns in a typical domain name. c = consonant / v = vowel / red circle = pattern to observe
However, in most cases, when analyzing DGAs, this pattern of alternating vowels and consonants is not present.
Example of a DGA in which there is no pattern of alternating consonants and vowels. c = consonant / v = vowel
It is the presence (or absence) of this pattern that the RNN detects, which allows it to determine whether words are pronounceable. And consequently, to classify them—or not—as DGA.
Syntactic analysis:
Another way to detect DGA is to use a syntactic approach. This type of approach allows for the analysis of the domain name’s content. For example, the domain name’s content can be analyzed by counting the number of vowels or consonants it contains.
In this type of approach, we create a list of elements that will allow us to define the domain name. These elements can be quite simple—such as the number of vowels or consonants in the domain name—or, conversely, more complex. Subsequently, all of these elements are fed into a machine learning algorithm that will learn to distinguish between normal domain names and DGA-type domain names.
Our Method
ITrust’s algorithm is capable of combining these two aspects: semantic analysis and syntactic analysis. This means that, to detect DGAs, we perform a dual analysis that ensures no aspect of domain names is left unmonitored.
In addition, our algorithms are trained on ITrust’s databases, which allows us to place a high degree of confidence in the results produced by our algorithms. This is because the larger the volume of data used to train the algorithms, the more robust the algorithms become.
AI: The Key to Modern Cybersecurity
In conclusion, this post illustrates the usefulness of machine learning techniques for cybersecurity. They enable an in-depth analysis of data across several aspects. (In this case, syntactic and semantic analysis, to evaluate the structure and pronunciation of the domain name.) People’s uses and needs are constantly growing, and with them the scope of systems that need to be monitored—which are increasingly exposed to vulnerabilities. In the face of this growing complexity, the advantages of machine learning justify its gradual replacement of traditional methods:
Analyze very large amounts of data automatically
Detect threats more quickly (in a matter of days, compared to several months using older methods)
Identify relationships among this data that an analyst might not notice; identify unknown threats
Save teams a significant amount of time, allowing them to focus on analyzing serious threats, while minor alerts are handled by AI.
Author: J. Johann – ITrust Data Science Team
Would you like to learn more?
