Unsurpervised DNS Exfil

Innovation in malicious tradecraft techniques including Malware, Advanced Persistent Threats (APT), rootkits, etc. has been well ahead of defensive tradecraft. Malicious actors have modernized and consolidated into commercially leveraged products sold on the dark web and other areas. Defensive tradecraft, which include mitigation & countermeasures take time to develop and may be rendered obsolete once completed due to the complexity and scale of adversarial tools. In addition, the amount of data that must be analyzed is growing exponentially with the increased reliance on connected devices, cloud services, and the internet in day-to-day life. The data includes signals or streams of interest as well as large volumes of noise. Hence it is inefficient, ineffective and unfeasible for a malware analyst to detect unknown malicious tradecraft, manually, without the assistance of automation. Clifton Roland Watkins Innovations (CRWI) proposes an unsupervised machine learning-based, first-order analytic system to associate observable data using an online clustering algorithm. CRWI will implement the Quality Threshold (Leader-Follower) algorithmic approach to create clusters of potential unknown malicious tradecraft based on thresholds provided by the analysts. This provides the following benefits: ● Reduce the required human analyst time and subject matter expertise ● Provide a method to focus on data of interest, and provide greater precision, by removing “uninteresting” clusters ● Gain insight into possible advanced persistent threats by a composition of clustered data (pointing out the unknown) ● Remove the need to predefine clusters and remove algorithmic inefficiencies such as k-nearest neighbor

Built With

• python