Almuthanna Alageel

Almuthanna Alageel

Ph.D. Student in Computing

Almuthanna A. Alageel is a Ph.D. student at Imperial College London in Cybersecurity. He received his MSc degree in Computer Science from the University of Colorado, Denver, USA. Before that, he obtained his BSc in Computer Engineering from King Saud University, Riyadh, KSA. He joined KACST, Computer Research Institute (CRI)-Security Group in 2009, then affiliated with The National Center for Artificial Intelligence (NCAI) in 2015 and The National Center for Cybersecurity (C4C) since 2016.

Scroll down for more details...

Hawk-Eye: Holistic Detection of APT Command and Control Domains

Lightning Talk

Advanced Persistence Threats; Command and Control Domains; Machine Learning

The high complexity and low volume of APT attacks has lead to limited insight into their behavior and to a scarcity of data, hindering research on effective detection techniques. In this paper we present a comprehensive study of the usage of domains in the context of the Command and Control (C&C) infrastructure of APTs, covering 63 APT campaigns spanning the last 13 years. We discuss the APT threat model, focusing in particular on evasion techniques, and collect an extensive dataset for studying APT C&C domains. Based on the gained insight, we propose a number of novel features to detect APTs, leveraging both semantic properties of the domains themselves and structural properties of their DNS infrastructure. We build Hawk-Eye, a system to classify domain names extracted from PCAP files, and use it to evaluate the performance of the various features we studied, and compare them to malicious domain detection features from the literature. We find that a holistic approach combining selected orthogonal features achieves the best performance, with an F1-score of 98.53% and a FPR of 0.35%.