OARC 44 (Atlanta, Georgia, USA)

Pink-Lemur - Convolutional Neural Network (CNN) DNS Tunneling Detection

7 Feb 2025, 11:55

25m

Imperial Salon B ( Atlanta Marriott Marquis)

In-Person Standard Presentation Main Session OARC 44 Day 2

Speakers

David Rodriguez (Cisco Systems)Dr Dejan Donin (Cisco)

Description

Pink-Lemur is a convolutional neural network trained to identify string encodings associated with data-exfiltration techniques in DNS. Using a character embedding table, and bottleneck convolutional architecture, we achieve an efficient and accurate technique to distinguish exfiltration and domain name labels that are prevalent in DNS. In addition to low false-positive requirements, fast and scalable performance is required. Using a custom tensor library developed in C, we translate PyTorch models into models that can run at the edge in DNS resolvers and classify traffic in realtime. We discuss implementation challenges that were overcome and discuss performance results of implementing this algorithm on a resolver host.

Presentation materials

OARC44-pink-lemur-2.pdf