Machine learning-based DNS request string representation with hash replacement
Techniques are described herein for using machine learning to learn vector representations of DNS requests such that the resulting embeddings represent the semantics of the DNS requests as a whole. Techniques described herein perform pre-processing of tokenized DNS request strings in which hashes, which are long and relatively random strings of characters, are detected in DNS request strings and each detected hash token is replaced with a placeholder token. A vectorizing ML model is trained using the pre-processed training dataset in which hash tokens have been replaced. Embeddings for the DNS tokens are derived from an intermediate layer of the vectorizing ML model. The encoding application creates final vector representations for each DNS request string by generating a weighted summation of the embeddings of all of the tokens in the DNS request string. Because of hash replacement, the resulting DNS request embeddings reflect semantics of the hashes as a group.
1. A computer-executed method comprising:
pre-processing a training dataset, that comprises a plurality of DNS request strings, to produce a pre-processed training dataset;
wherein pre-processing the training dataset comprises:
tokenizing the plurality of DNS request strings, in the training dataset, to produce a corresponding plurality of tokenized DNS strings;
for each tokenized DNS string of one or more tokenized DNS strings, from the plurality of tokenized DNS strings:
identifying a hash token, in said each tokenized DNS string based, at least in part, on a length of the hash token and a number of unique characters in the hash token, and
replacing the identified hash token with a particular placeholder token;
training a vectorizing machine learning (ML) model based, at least in part, on the pre-processed training dataset to produce a trained vectorizing ML model; and
generating vector representations of the plurality of DNS request strings based, at least in part, on DNS token embeddings in an intermediate layer of the trained vectorizing ML model;
wherein the method is performed by one or more computing devices.
2. The computer-executed method of claim 1 , wherein training the vectorizing ML model comprises training the vectorizing ML model to predict a particular DNS token given one or more context tokens, other than the particular DNS token, from a particular DNS request string of the pre-processed training dataset.
3. The computer-executed method of claim 1 , wherein training the vectorizing ML model comprises training the vectorizing ML model to predict one or more context DNS tokens, of a particular DNS request string of the pre-processed training dataset, given a particular DNS token from the particular DNS request string.
4. The computer-executed method of claim 1 , wherein identifying the hash token comprises calculating a logarithm of the number of unique characters in the hash token multiplied by the length of the hash token.
5. The computer-executed method of claim 1 , wherein identifying the hash token comprises calculating an entropy metric for the hash token and determining that the entropy metric exceeds a threshold metric.
6. The computer-executed method of claim 5 , further comprising deriving the threshold metric from the training dataset.
7. The computer-executed method of claim 1 , further comprising training a second ML model based, at least in part, on the vector representations of the plurality of DNS request strings to produce a trained second ML model.
8. The computer-executed method of claim 7 , wherein the plurality of DNS request strings is a first plurality of DNS request strings, and wherein the method further comprises using the trained second ML model to predict that second one or more DNS request strings, from a second plurality of DNS request strings other than the first plurality of DNS request strings, represent exfiltration attacks.
9. The computer-executed method of claim 7 , wherein the plurality of DNS request strings is a first plurality of DNS request strings, and wherein the method further comprises using the trained second ML model to predict that second one or more DNS request strings, from a second plurality of DNS request strings other than the first plurality of DNS request strings, are anomalous DNS request strings.
10. One or more non-transitory computer-readable media storing one or more sequences of instructions that, when executed by one or more processors, cause:
pre-processing a training dataset, that comprises a plurality of DNS request strings, to produce a pre-processed training dataset;
wherein pre-processing the training dataset comprises:
tokenizing the plurality of DNS request strings, in the training dataset, to produce a corresponding plurality of tokenized DNS strings;
for each tokenized DNS string of one or more tokenized DNS strings, from the plurality of tokenized DNS strings:
identifying a hash token, in said each tokenized DNS string based, at least in part, on a length of the hash token and a number of unique characters in the hash token, and
replacing the identified hash token with a particular placeholder token;
training a vectorizing machine learning (ML) model based, at least in part, on the pre-processed training dataset to produce a trained vectorizing ML model; and
generating vector representations of the plurality of DNS request strings based, at least in part, on DNS token embeddings in an intermediate layer of the trained vectorizing ML model.
11. The one or more non-transitory computer-readable media of claim 10 , wherein training the vectorizing ML model comprises training the vectorizing ML model to predict a particular DNS token given one or more context tokens, other than the particular DNS token, from a particular DNS request string of the pre-processed training dataset.
12. The one or more non-transitory computer-readable media of claim 10 , wherein training the vectorizing ML model comprises training the vectorizing ML model to predict one or more context DNS tokens, of a particular DNS request string of the pre-processed training dataset, given a particular DNS token from the particular DNS request string.
13. The one or more non-transitory computer-readable media of claim 10 , wherein identifying the hash token comprises calculating a logarithm of the number of unique characters in the hash token multiplied by the length of the hash token.
14. The one or more non-transitory computer-readable media of claim 10 , wherein identifying the hash token comprises calculating an entropy metric for the hash token and determining that the entropy metric exceeds a threshold metric.
15. The one or more non-transitory computer-readable media of claim 14 , wherein the one or more sequences of instructions further comprise instructions that, when executed by one or more processors, cause deriving the threshold metric from the training dataset.
16. The one or more non-transitory computer-readable media of claim 10 , wherein the one or more sequences of instructions further comprise instructions that, when executed by one or more processors, cause training a second ML model based, at least in part, on the vector representations of the plurality of DNS request strings to produce a trained second ML model.
17. The one or more non-transitory computer-readable media of claim 16 , wherein the plurality of DNS request strings is a first plurality of DNS request strings, and wherein the one or more sequences of instructions further comprise instructions that, when executed by one or more processors, cause using the trained second ML model to predict that second one or more DNS request strings, from a second plurality of DNS request strings other than the first plurality of DNS request strings, represent exfiltration attacks.
18. The one or more non-transitory computer-readable media of claim 16 , wherein the plurality of DNS request strings is a first plurality of DNS request strings, and wherein the one or more sequences of instructions further comprise instructions that, when executed by one or more processors, cause using the trained second ML model to predict that second one or more DNS request strings, from a second plurality of DNS request strings other than the first plurality of DNS request strings, are anomalous DNS request strings.