Since 2018 and the release of the first version of Reveelium, the team at ITrust has been convinced of the value of artificial intelligence for cybersecurity. In recent years, market trends have proven us right: from small and medium-sized enterprises to industry giants, all rely on this technology to increase their ability to detect threats tenfold.
But what do we mean by AI?
Reveelium is not yet capable of thinking like a human, and therefore does not replace the expertise of an experienced SOC analyst. That said, ITrust’s use of AI goes far beyond the IF/THEN rules—even optimized ones—that have long formed the basis of this highly human-supervised decision-making system.
Making a decision in a predefined situation is not proof of intelligence. Traditionally, the correlation rules in SIEMs are static and fixed. They do not adapt to new situations, nor do they learn from their mistakes.
However, this concept of learning is crucial for identifying the multitude of new threats that companies are facing and for countering the increasingly complex and sophisticated attacks by cybercriminals.
In response to this reality, ITrust’s data scientists have been developing our own machine learning algorithms for several years. Their goal: to continuously improve threat detection by identifying relationships among thousands of logs that a human would not necessarily notice.
In a previous post, we discussed the Kryptis malware and how we were able to detect it using the three-pronged approach: SIEM and UEBA / Threat Intelligence / Human Expertise.
Today we’d like to focus on the UEBA engine of our Reveelium technology by introducing one of its algorithms: the DGA. Without going into detail about exactly how it works, we’ll simply explain the temporal and syntactic analysis methods that make this algorithm valuable for malware detection.
Reminder about Kryptis malware:
It is a Trojan malware (Trojan Horse) that, once installed, can be remotely controlled by the attacker (Command & Control). It is used to steal information such as usernames, passwords, or sensitive files (exfiltration). It can also take screenshots, record keystrokes (keylogging), monitor network traffic, launch executable files… and send all this information to a remote server controlled by an attacker.
DGA:
In this cyberattack, it was our DGA detection algorithm that detected the spread of the Kryptis malware, thanks to the correlation of one of our alerts with SIEM alerts.
But what is a DGA?
DGA (Domain Generation Algorithm) is a technique used by cyber attackers to generate new domain names for malware command-and-control servers. Detecting DGAs is crucial, as it can lead to the early detection of known or unknown malware.
What is the value of AI?
An interesting question to ask is: What is the benefit of AI in detecting DGA? The answer is simple: AI enables a more advanced analysis of domain names. It allows for both semantic and syntactic analysis of domain names, thereby enabling more accurate—and therefore more efficient—classification.
Semantic analysis:
Semantic analysis is the process used to determine whether a domain name is pronounceable. In other words, it helps us determine whether the domain name we are examining is pronounceable or not. But above all, it helps us determine to what extent it is pronounceable.
To perform this semantic analysis, the most commonly used algorithms are deep learning algorithms, specifically RNNs (Recurrent Neural Networks). RNNs are deep learning algorithms (neural networks) that perform a temporal analysis of data (recurrent). The great strength of this type of algorithm is that it allows us to observe the recurrence of certain patterns.
This algorithm is used to detect DGA as follows: when we examine certain words (in French or English) or domain names, patterns emerge, such as the alternation between consonants and vowels.
Observation of the patterns in a typical domain name. c = consonant / v = vowel / red circle = pattern to observe
However, most of the time, when we analyze DGA, this pattern of alternating between vowels and consonants is not present.
Example of a DGA in which no pattern is found involving an alternation between consonants and vowels. c = consonant / v = vowel
It is the presence (or absence) of this pattern that the RNN detects, and that allows it to determine whether words can be pronounced. And consequently, to classify them—or not—as DGA.
Syntactic analysis:
Another way to detect DGAs is to use a syntactic approach. This type of approach makes it possible to analyze the content of the domain name. For example, the content of the domain name can be analyzed by counting the number of vowels or consonants it contains.
In this type of approach, we create a list of elements that will allow us to define the domain name. These elements can be quite simple—such as the number of vowels or consonants in the domain name—or more complex. Then, all these elements are fed into a machine learning algorithm that will learn to distinguish between normal domain names and DGA domain names.
Our method:
ITrust’s algorithm is capable of combining both semantic and syntactic analysis. This means that, to detect DGAs, we perform a two-pronged analysis that ensures no aspect of the domain names is overlooked.
In addition, our algorithms are trained on ITrust’s databases, which allows us to ensure a high level of reliability in the results produced by our algorithms. The larger the volume of data used to train the algorithms, the more robust the algorithms are.
AI: The Key to Modern Cybersecurity
In conclusion, this post illustrates the usefulness of machine learning techniques for cybersecurity. They enable an in-depth analysis of data across several dimensions. (In this case, syntactic and semantic analysis, to evaluate the structure and pronunciation of the domain name.) The uses and needs of the public continue to grow, and with them the scope of what needs to be monitored—which is increasingly exposed to vulnerabilities. Faced with this growing complexity, the advantages of machine learning justify its gradual replacement of traditional methods:
Analyzing very large amounts of data automatically
Speeding up the detection of threats (a few days, compared to several months using the old methods)
Identifying relationships between these data that an analyst might not notice; identifying unknown threats
Saving a significant amount of time so that staff can focus on analyzing serious threats, while minor alerts are handled by AI.
Author: J. Johann – Data Science Team at ITrust
