Fine-tuning Large Language Models for DGA and DNS Exfiltration Detection

TL;DR

This paper demonstrates that fine-tuned Large Language Models can effectively detect Domain Generation Algorithms and DNS exfiltration attacks, outperforming traditional methods in real-world cybersecurity scenarios.

Contribution

First empirical application of fine-tuned LLMs for DGA and DNS exfiltration detection, showing significant improvements over existing techniques.

Findings

LLMs outperform traditional NLP methods in DGA detection

High accuracy in identifying unknown DGAs

Effective in detecting DNS exfiltration attacks

Abstract

Domain Generation Algorithms (DGAs) are malicious techniques used by malware to dynamically generate seemingly random domain names for communication with Command & Control (C&C) servers. Due to the fast and simple generation of DGA domains, detection methods must be highly efficient and precise to be effective. Large Language Models (LLMs) have demonstrated their proficiency in real-time detection tasks, making them ideal candidates for detecting DGAs. Our work validates the effectiveness of fine-tuned LLMs for detecting DGAs and DNS exfiltration attacks. We developed LLM models and conducted comprehensive evaluation using a diverse dataset comprising 59 distinct real-world DGA malware families and normal domain data. Our LLM model significantly outperformed traditional natural language processing techniques, especially in detecting unknown DGAs. We also evaluated its performance on DNS exfiltration datasets, demonstrating its effectiveness in enhancing cybersecurity measures. To the best of our knowledge, this is the first work that empirically applies LLMs for DGA and DNS exfiltration detection.