heiDGAF
Please be aware that this research project will be continued in our new project “ASTRAOS”!
Aims & Objectives
heiDGAF is a framework to detect DGA attacks in network traffic. The project is designed to process large quantities of traffic in real-time. Besides DGA attacks, the framework is capable of featuring further detectors to spot more attack types. We are currently focusing on DNS traffic. In the near future we plan on supporting also HTTP traffic and detectors.
Research topics
Extension of heiDGAF to a CIDS
traditional network based IDS are focusing on one choke point on the network on which they operate. As this approach fails to detect attacks distributed over multiple network segments, CIDS are introduced. To maximize the detection capabilities of heiDGAF, we are focusing on redesigning it to a CIDS, able to monitor multiple network segments at once for attacks.
Extending DNS attack detection capabilities
The project started to spot DGAs in the DNS traffic of the university network. As these are not the only type of malicious DNS traffic that can be observed we are evaluating further detection methods based on the DNS protocol, to prevent such attacks. Amongst others, we strive to build detectors for water torture attacks, tunneling attacks, and amplification attacks.
Including a more diverse set of traffic protocols for analysis
Currently, the framework is primed on DNS traffic, especially for DGAs. As the design of the system is modular, we plan on extending the capabilities to also analyze more protocols such as FTP, HTTP, etc.
Automatic benchmarking for continuous improvement
To fully understand performance impacts of changes, an exhaustive benchmarking process is paramount. This process needs to be included into existing and future workflows to support the development lifecycle and allow for finding the most performant solution design.
Funding
-
People from the EMCL
Contact
Links
Publications
- Machmeier, S., Ludwig, M., Fuchs, M. and Heuveline, V., "heiDGAF: A Novel Open-Source CIDS Solution for DGA Detection", in 2025 15th SPRING graduate workshop, pp. 42, Nuremberg, Germany, 2025
