Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama

[<[e-mail]>]

Hi Jerome,

Thanks. Yes you are perfectly right, we aim at detecting DGA Bots. 
However, as you mentioned, we did not address the problems and mechanisms of the domain names generation itself.  
We have actually written a paper about these works, it is now under review, we will release it after. 

Best regards,
Stephane 

-----Message d'origine-----
De : Jérôme François [mailto:[e-mail]] 
Envoyé : mercredi 14 octobre 2015 14:51
À : Daniel Migault; SENECAL Stephane IMT/OLN; [e-mail]
Cc : KHEIR Nizar IMT/OLPS
Objet : Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama

Hi Daniel

Le 14/10/2015 02:19, Daniel Migault a écrit :
> Hi,
>
> The purpose of the DNS traffic was to detect CC. The traffic was only composed of NX domain. We clustered FQDNs based on shared IP addresses to identify Bots. Then infected hosts with corresponding bots were detected by looking at the time series of NX response.
Looks very interesting as well. I guess so your target is randomly generated domain. Did you also look at the how such domains look like, i.e. how they have been generated ?

BR,
jerome

> BR,
> Daniel
>
> -----Original Message-----
> From: Jérôme François [mailto:[e-mail]]
> Sent: Tuesday, October 13, 2015 12:06 PM
> To: [e-mail]; [e-mail]
> Cc: Daniel Migault; KHEIR Nizar IMT/OLPS
> Subject: Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama
>
> Hi Stephane,
>
> What is the purpose of your DNS traffic analysis.
> I did also some work (not only aggregation) using semantic analysis of domain name, and even URL, for fighting phishing.
> Using some Natural Language Processing (NLP) techniques, we basically tried to define a phisher's language such that people will feel secure with the url they are accessing on.
>
> Best regards,
> jerome
>
>
> Le 13/10/2015 09:53, [e-mail] a écrit :
>> Hi Jerome, All,
>>
>> Yes indeed this topic is relevant and very interesting. 
>>
>> Actually we (Daniel and Nizar in cc and I) considered and used clustering approaches for pre-processing DNS traffic traces before applying ML techniques (supervised learning, namely a variant of decision trees) for addressing network security issues. 
>>
>> We would be very interested in listening to your presentation. 
>>
>> BTW Sheng, Brian, do you already know the date and time which will be allocated for this NMLRG session at the forthcoming IETF-94?
>> Also, will it be possible to participate to the session via conf call? 
>> Thanks
>>
>> Best regards,
>> Stephane
>>  
>> Stephane SENECAL
>> Research Engineer/Scientist
>> Orange Labs
>> [phone]
>> [e-mail]
>>
>>
>> -----Message d'origine-----
>> De : nmlrg [mailto:[e-mail]] De la part de Jérôme 
>> François Envoyé : lundi 12 octobre 2015 22:21 À : [e-mail] 
>> Objet
>> : Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama
>>
>> Hi all,
>>
>> I recently introduced a fingerprinting use case on the ML that I could present but I was wondering if it would not better to present something about heterogenous data aggregation.
>>
>> We actually build a method to aggregate multi-dimensional data within a single tree structure without assuming any order between dimensions and with variable granularity. It is a kind of mix between k-dimensional tree and density-based clustering. For example, we applied it to DNS answers aggregating both domain names and IP address in a single data structure to be analyzed rather than an individual record inspection to first identify time period where some divergent behavior appears.
>>
>> I know that it is not ML itself but we used it is fully in the scope of data representation and pre-processing of ML.
>>
>> So, would that topic be interesting for NMLRG participants?
>>
>> Best regards,
>> jerome
>>
>> Le 08/10/2015 05:28, Sheng Jiang a écrit :
>>> Hi, all,
>>>
>>> We have been assigned one session of 2.5 hour for the proposed NMLRG 
>>> (Network Machine Learning Research Group) meeting for
>>> IETF-94 (Yokohama) and are starting to collect agenda items for this 
>>> session.
>>>
>>> The proposed NML RG is still in the very initial stage. So, we have 
>>> very open scope. We do not restrict the topics. The only threshold 
>>> is it should be relevant to network or network devices, using Machine Learning.
>>>
>>> Please send us ([e-mail], [e-mail]) 
>>> requests for sessions and include:
>>>
>>> Name of time slot:
>>> Name of topic(s):
>>> Time requested:
>>> Presenter name(s):
>>> Brief description of the topic:
>>>
>>> More details about the Yokohama IETF can be found at 
>>> http://www.ietf.org/meeting/94/index.html.
>>>
>>> Also, presenters please invoke discussions in the NMLRG list. We 
>>> have limited time in the face-to-face meeting. Mail list is a good 
>>> place to propagate and discuss the topics.
>>>
>>> Best regards,
>>>
>>> Brian & Sheng
>>> _______________________________________________
>>> nmlrg mailing list
>>> [e-mail]
>>> https://www.irtf.org/mailman/listinfo/nmlrg
>> _______________________________________________
>> nmlrg mailing list
>> [e-mail]
>> https://www.irtf.org/mailman/listinfo/nmlrg
>>
>> _____________________________________________________________________
>> _ ___________________________________________________
>>
>> Ce message et ses pieces jointes peuvent contenir des informations 
>> confidentielles ou privilegiees et ne doivent donc pas etre diffuses, 
>> exploites ou copies sans autorisation. Si vous avez recu ce message 
>> par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
>>
>> This message and its attachments may contain confidential or 
>> privileged information that may be protected by law; they should not be distributed, used or copied without authorisation.
>> If you have received this email in error, please notify the sender and delete this message and its attachments.
>> As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
>> Thank you.
>>


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
France Telecom - Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorization.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, France Telecom - Orange shall not be liable if this message was modified, changed or falsified.
Thank you.