An end-to-end framework for private DGA detection as a service

Area of Science:

• Cybersecurity
• Machine Learning
• Privacy-Enhancing Technologies

Background:

• Domain Generation Algorithms (DGAs) are crucial for malware command and control.
• Existing DGA detection methods using machine learning (ML) raise privacy concerns when offered as a service.
• Network administrators are hesitant to share DNS traffic due to privacy risks.

Purpose of the Study:

• To propose the first end-to-end framework for privacy-preserving DGA classification as a service.
• To enable secure outsourcing of DGA detection without revealing DNS data or ML models.
• To ensure classification results do not compromise training data privacy.

Main Methods:

• Combining secure multi-party computation (MPC) and differential privacy (DP) for privacy-preserving classification.
• Utilizing post-training float16 quantization of deep learning models within MPC for efficiency.
• Implementing a three-party secure computation protocol tolerating one corruption.

Main Results:

• Achieved significant speed-up in DGA detection (23% to 42% reduction in inference runtime) through quantization.
• Maintained classification accuracy without compromising privacy guarantees.
• Demonstrated an end-to-end private solution, unlike previous approaches.

Conclusions:

• The proposed framework offers a secure and efficient solution for DGA detection as a service.
• The integration of MPC and DP effectively addresses privacy concerns in DGA classification.
• Quantization significantly enhances the performance of privacy-preserving ML models in cybersecurity applications.