Librarian - A C2 Domain Scanner

Overview

Librarian is an open-weight Neural Network trained to detect and flag C2 Domains generated by DGA algorithms.

---

Features

• Lightweight Structure
  The model uses a lightweight structure, allowing it to be easily run on DNS recursion servers to stop C2 malware

• High Accuracy The model reaches 95.13% accuracy, similar to rates reached by academic papers

• Ensemble Inference 3 files are used with soft voting to maximise efficacy

• Automatic Threshold Calculation Optimal threshold is automatically found from validation data

---

Architecture Overview

• Python is used to train the model

  • Tensorflow and Keras were used for training
  • 11 inputs are mathematically calculated for the model

• Dense Swish layers - 32 -> 64 -> 32 -> 16 -> 1

Input Features (11 Dimensions)

Features extracted:

1. Shannon Entropy (normalized randomness score)
2. Vowel-Consonant Ratio
3. Longest Consecutive Consonants
4. Dictionary Count (matching top 10k English words)
5. Bigram Distribution
6. Trigram Distribution
7. Total Length
8. Digit Percentage
9. Longest Consecutive Digits
10. Letter/Digit/Symbol Transition Count
11. Index of Coincidence

Configuration

{
  "DB Path": "path/to/domains.db",
  "Learning Rate": 0.001,
  "Batch Size": 256,
  "Num Epochs": 10000,
  "Num Training Entries": 180000
}

---

Future Improvements

• GAN training to experiment with adversarial generation techinques

• NEAT implementation to further reduce the model's resource cost

---

Notes

• The model is a series of 3, found under Effective Model 6
  • Soft voting is used automatically
  • The system calculates the optimal threshold from the testing data