Fine-tuning Large Language Models for DGA and DNS Exfiltration Detection

Fuente: arXiv

Salvato in:

Dettagli Bibliografici
Autori principali:	Sayed, Md Abu, Rahman, Asif, Kiekintveld, Christopher, Garcia, Sebastian
Natura:	Preprint
Pubblicazione:	2024
Soggetti:	Cryptography and Security
Accesso online:	Acceder al recurso
Tags:	Aggiungi Tag Nessun Tag, puoi essere il primo ad aggiungerne!!

Documenti analoghi

Coordinated Multi-Domain Deception: A Stackelberg Game Approach
di: Sayed, Md Abu, et al.
Pubblicazione: (2026)

Improving DNS Exfiltration Detection via Transformer Pretraining
di: Tomić, Miloš, et al.
Pubblicazione: (2026)

Evasion-Resilient Detection of DNS-over-HTTPS Data Exfiltration: A Practical Evaluation and Toolkit
di: Elaoumari, Adam
Pubblicazione: (2025)

ss2DNS: A Secure DNS Scheme in Stage 2
di: Jahromi, Ali Sadeghi, et al.
Pubblicazione: (2024)

MAD-OOD: A Deep Learning Cluster-Driven Framework for an Out-of-Distribution Malware Detection and Classification
di: Ige, Tosin, et al.
Pubblicazione: (2025)

An Investigation into the Performances of the State-of-the-art Machine Learning Approaches for Various Cyber-attack Detection: A Survey
di: Ige, Tosin, et al.
Pubblicazione: (2024)

Verifying LLM Inference to Detect Model Weight Exfiltration
di: Rinberg, Roy, et al.
Pubblicazione: (2025)

AssessITS: Integrating procedural guidelines and practical evaluation metrics for organizational IT and Cybersecurity risk assessment
di: Rahman, Mir Mehedi, et al.
Pubblicazione: (2024)

A Survey of Network Requirements for Enabling Effective Cyber Deception
di: Sayed, Md Abu, et al.
Pubblicazione: (2023)

Optimizing DDoS Detection in SDNs Through Machine Learning Models
di: Haque, Md. Ehsanul, et al.
Pubblicazione: (2025)

A Simple Data Exfiltration Game
di: Caulfield, Tristan
Pubblicazione: (2025)

Case Study: Fine-tuning Small Language Models for Accurate and Private CWE Detection in Python Code
di: Bappy, Md. Azizul Hakim, et al.
Pubblicazione: (2025)

Implementing ISO/IEC TS 27560:2023 Consent Records and Receipts for GDPR and DGA
di: Pandit, Harshvardhan J., et al.
Pubblicazione: (2024)

FSCsec: Collaboration in Financial Sector Cybersecurity -- Exploring the Impact of Resource Sharing on IT Security
di: Sayeed, Sayed Abu, et al.
Pubblicazione: (2024)

Practical Secure Inference Algorithm for Fine-tuned Large Language Model Based on Fully Homomorphic Encryption
di: Ruoyan, Zhang, et al.
Pubblicazione: (2025)

Differentially Private Parameter-Efficient Fine-tuning for Large ASR Models
di: Liu, Hongbin, et al.
Pubblicazione: (2024)

Navigating the Designs of Privacy-Preserving Fine-tuning for Large Language Models
di: Shi, Haonan, et al.
Pubblicazione: (2025)

Fine-tuning of Large Language Models for Domain-Specific Cybersecurity Knowledge
di: Huang, Yuan
Pubblicazione: (2025)

Registration, Detection, and Deregistration: Analyzing DNS Abuse for Phishing Attacks
di: Lim, Kyungchan, et al.
Pubblicazione: (2025)

Antidote: Post-fine-tuning Safety Alignment for Large Language Models against Harmful Fine-tuning
di: Huang, Tiansheng, et al.
Pubblicazione: (2024)

PriFFT: Privacy-preserving Federated Fine-tuning of Large Language Models via Hybrid Secret Sharing
di: You, Zhichao, et al.
Pubblicazione: (2025)

Data Exfiltration by Compression Attack: Definition and Evaluation on Medical Image Data
di: Li, Huiyu, et al.
Pubblicazione: (2025)

EMPalm: Exfiltrating Palm Biometric Data via Electromagnetic Side-Channel
di: Xu, Haowen, et al.
Pubblicazione: (2025)

Deep Learning-Based Speech and Vision Synthesis to Improve Phishing Attack Detection through a Multi-layer Adaptive Framework
di: Ige, Tosin, et al.
Pubblicazione: (2024)

Detection of Distributed Denial of Service Attacks based on Machine Learning Algorithms
di: Rahman, Md. Abdur
Pubblicazione: (2025)

The MESA Security Model 2.0: A Dynamic Framework for Mitigating Stealth Data Exfiltration
di: Singh, Sanjeev Pratap, et al.
Pubblicazione: (2024)

DECIFR: Domain-Aware Exfiltration of Circuit Information from Federated Gradient Reconstruction
di: Lee, Gijung, et al.
Pubblicazione: (2026)

Malicious GenAI Chrome Extensions: Unpacking Data Exfiltration and Malicious Behaviours
di: Seetharam, Shresta B., et al.
Pubblicazione: (2025)

EnchTable: Unified Safety Alignment Transfer in Fine-tuned Large Language Models
di: Wu, Jialin, et al.
Pubblicazione: (2025)

Domainator: Detecting and Identifying DNS-Tunneling Malware Using Metadata Sequences
di: Petrov, Denis, et al.
Pubblicazione: (2025)

Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration
di: Das, Debeshee, et al.
Pubblicazione: (2026)

PhishGuard: A Multi-Layered Ensemble Model for Optimal Phishing Website Detection
di: Ovi, Md Sultanul Islam, et al.
Pubblicazione: (2024)

A Survey and Evaluation Framework for Secure DNS Resolution
di: Jahromi, Ali Sadeghi, et al.
Pubblicazione: (2025)

Embedding with Large Language Models for Classification of HIPAA Safeguard Compliance Rules
di: Rahman, Md Abdur, et al.
Pubblicazione: (2024)

LLUAD: Low-Latency User-Anonymized DNS
di: Sjösvärd, Philip, et al.
Pubblicazione: (2025)

ODoQ: Oblivious DNS-over-QUIC
di: Kulkarni, Aditya, et al.
Pubblicazione: (2025)

Predicting memorization within Large Language Models fine-tuned for classification
di: Dentan, Jérémie, et al.
Pubblicazione: (2024)

QUIC-Exfil: Exploiting QUIC's Server Preferred Address Feature to Perform Data Exfiltration Attacks
di: Grübl, Thomas, et al.
Pubblicazione: (2025)

Private Fine-tuning of Large Language Models with Zeroth-order Optimization
di: Tang, Xinyu, et al.
Pubblicazione: (2024)

Assessing Generalisation Capability of Machine Learning Models for Intrusion Detection
di: Hossain, Md Zakir, et al.
Pubblicazione: (2026)

if (filemtime($filename) + $maxlifetime < time()) { unlink($filename); $count++; } } return $count; } /** * A function that is called internally when session data is to be saved. * * @param string $sessId The current session ID * @param string $data The session data to write * * @return bool */ protected function saveSession($sessId, $data): bool { $sessFile = $this->path . '/sess_' . $sessId; if ($handle = fopen($sessFile, 'w')) { $return = false; // Lock the file for exclusive access to avoid issues with multiple // processes writing session simultaneously: if (flock($handle, LOCK_EX)) { $return = fwrite($handle, $data); // Make sure that there's no trailing data by truncating the file to // the correct length: ftruncate($handle, strlen($data)); fflush($handle); flock($handle, LOCK_UN); } fclose($handle); if ($return !== false) { return true; } } // If we got this far, something went wrong with the file output... // It is tempting to throw an exception here, but this code is called // outside of the context of exception handling, so all we can do is // echo a message.

// Anecdotal testing Today and Yesterday seems to indicate destroy() // is called by the garbage collector and everything is good. // Something to keep in mind though. return 0; } /** * Write function that is called when session data is to be saved. * * @param string $sessId The current session ID * @param string $data The session data to write * * @return bool */ public function write($sessId, $data): bool { if ($this->writesDisabled) { return true; } return $this->saveSession($sessId, $data); } /** * A function that is called internally when session data is to be saved. * * @param string $sessId The current session ID * @param string $data The session data to write * * @return bool */ abstract protected function saveSession($sessId, $data): bool; }

* * @return void */ public function writeClose() { // The assumption is that we're using PHP's ext/session. // session_write_close() will actually overwrite $_SESSION with an // empty array on completion -- which leads to a mismatch between what // is in the storage object and $_SESSION. To get around this, we // temporarily reset $_SESSION to an array, and then re-link it to // the storage object. // // Additionally, while you _can_ write to $_SESSION following a // session_write_close() operation, no changes made to it will be // flushed to the session handler. As such, we now mark the storage // object isImmutable. $storage = $this->getStorage(); if (! $storage->isImmutable()) { $_SESSION = $storage->toArray(true); session_write_close(); $storage->fromArray($_SESSION); $storage->markImmutable(); } } /** * Attempt to set the session name * * If the session has already been started, or if the name provided fails * validation, an exception will be raised. * * @param string $name * @return SessionManager * @throws Exception\InvalidArgumentException */ public function setName($name) { if ($this->sessionExists()) { throw new Exception\InvalidArgumentException( 'Cannot set session name after a session has already started'

Environment & details:

GET Data empty

POST Data empty

Files empty

Key	Value
VUFIND_SESSION	"3eaea89beef94a429f4e4dabc58f1a95"
ui	"standard"
language	"it"

Session

Key	Value
__Laminas	array:2 [`"_REQUEST_ACCESS_TIME" => 1790301346.9283 "_VALID" => array:1 [ "Laminas\Session\Validator\Id" => "3eaea89beef94a429f4e4dabc58f1a95" ]`]
SessionState	Laminas\Stdlib\ArrayObject {#938}
FlashMessenger	Laminas\Stdlib\ArrayObject {#1433}
SessionHelper	Laminas\Stdlib\ArrayObject {#1759}

Server/Request Data

Key	Value
REDIRECT_VUFIND_LOCAL_DIR	"/usr/local/vufind/local"
REDIRECT_HTTPS	"on"
REDIRECT_SSL_TLS_SNI	"info.umar.mx"
REDIRECT_STATUS	"200"
VUFIND_LOCAL_DIR	"/usr/local/vufind/local"
HTTPS	"on"
SSL_TLS_SNI	"info.umar.mx"
HTTP_ACCEPT	"/"
HTTP_USER_AGENT	"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)"
HTTP_COOKIE	"VUFIND_SESSION=3eaea89beef94a429f4e4dabc58f1a95; ui=standard; language=it"
HTTP_ACCEPT_ENCODING	"gzip, br, zstd, deflate"
HTTP_HOST	"info.umar.mx"
PATH	"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/snap/bin"
SERVER_SIGNATURE	"<address>Apache/2.4.66 (Ubuntu) Server at info.umar.mx Port 443</address>\n"
SERVER_SOFTWARE	"Apache/2.4.66 (Ubuntu)"
SERVER_NAME	"info.umar.mx"
SERVER_ADDR	"200.23.222.19"
SERVER_PORT	"443"
REMOTE_ADDR	"216.73.216.147"
DOCUMENT_ROOT	"/usr/local/vufind/public"
REQUEST_SCHEME	"https"
CONTEXT_PREFIX	""
CONTEXT_DOCUMENT_ROOT	"/usr/local/vufind/public"
SERVER_ADMIN	"admin@localhost"
SCRIPT_FILENAME	"/usr/local/vufind/public/index.php"
REMOTE_PORT	"54232"
REDIRECT_URL	""" /Record/\n arxiv_https___arxiv_org_abs_2410_21723/Similar """
GATEWAY_INTERFACE	"CGI/1.1"
SERVER_PROTOCOL	"HTTP/1.1"
REQUEST_METHOD	"GET"
QUERY_STRING	""
REQUEST_URI	"/Record/%0Aarxiv_https___arxiv_org_abs_2410_21723/Similar"
SCRIPT_NAME	"/index.php"
PHP_SELF	"/index.php"
REQUEST_TIME_FLOAT	1790301346.924
REQUEST_TIME	1790301346

Environment Variables empty

Registered Handlers

0. Whoops\Handler\PrettyPageHandler