{"id":1321,"date":"2021-11-01T16:20:13","date_gmt":"2021-11-01T16:20:13","guid":{"rendered":"https:\/\/sappan-project.eu\/?p=1321"},"modified":"2021-11-02T11:41:18","modified_gmt":"2021-11-02T11:41:18","slug":"detecting-suspicious-ch-domains-using-deep-neural-networks","status":"publish","type":"post","link":"https:\/\/sappan-project.eu\/?p=1321","title":{"rendered":"Detecting suspicious *.ch-domains using deep neural networks"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
By Mischa Obrecht (Dreamlab Technologies AG Switzerland) <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
The SAPPAN consortium has been researching several different use cases for new detection methods, such as the

\nclassification of phishing websites or algorithmically generated domains (AGDs). Both topics were tackled using deep neural

network classifiers, achieving good accuracy on training and validation data mostly based on the English language. In this

article, we use the aforementioned models to classify the *.ch domain space which was recently made public by the entity

managing the .ch and .li country-code top-level domains for Switzerland and Lichtenstein (switch.ch). <\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

As switch.ch<\/a>\nrecently published the .ch-zonefile [<\/span>1<\/span>], we have access to a snapshot of all registered *.ch\ndomains, including all the domains that may never have been configured to\nresolve to an IP, are not linked to by any websites or webservices and are thus\nnot discovered by web-crawlers like Google<\/span>. <\/span><\/p>\n\n

Modern remote\ncontrolled malware (so called remote access toolkits, that are widely used by\nadvanced persistent threats, APTs) communicates with its handler. This is\ncalled command and control (C2). In most cases the malware will contact a\npublic rendezvous server or public proxy (e.g. a virtual private server on AWS)\nto obtain instructions from its handler in more or less regular intervals. This\nis called beaconing.<\/span><\/p>\n\n\n\n\n\n