Search

Person re-identification (re-ID) aims to match person images under different cameras with disjoint views. Although supervised re-ID has achieved great progress, unsupervised cross-domain re-ID remains a challenging work due to domain bias. In this work, we divide cross-domain re-ID task into two phases: domain-invariant features learning and domain-specific features learning. Our contributions are twofold. (i) To achieve domain-invariant features learning, a novel model called Pedestrian General Similarity (PGS) is proposed, which can eliminate two main factors that cause domain bias: image style and background. Compared with the existing re-ID models, PGS has better generalization ability. (ii) A novel pseudo label assignment method named Mutual Nearest Neighbors Pseudo Labeling (MNNPL) is proposed, which calculates pseudo labels based on the similarity between samples in the target domain, and the resulting pseudo labels are used to guide domain-specific feature learning. Extensive experiments are conducted on several large scale datasets, the results show that our method outperforms most published unsupervised cross-domain methods by a large margin.

Person re-identification (Re-ID) is aimed to identify the same person under different cameras with disjoint views. With the development of deep learning, supervised Re-ID has made great progress. However, most methods fail to be generalized to new domains due to the potential image distinctions between different domains, making it difficult to be applied in practical use. We propose an unsupervised domain-adaptive person re-identification method based on style transfer (STReID) to improve model cross-domain capability. In this work, a novel style transfer framework is proposed for Re-ID, which allows us to change the style of images while retaining content information. Specifically, STReID mainly includes two steps: first, each image in the source domain is converted into the target domain style and the identity (ID) information remains unchanged. Then the source domain images and style transferred images are combined to train a style-independent Re-ID model. Experiments show that our method achieves higher performance of unsupervised cross-domain person Re-ID.

Malicious domains are critical resources in network security, behind which attackers hide malware to launch the malicious attacks. Therefore, blocking malicious domains is the most effective and practical way to combat and reduce hostile activities. There are three limitations in previous methods over domain classification: (1) solely based on local domain features which tend to be not robust enough; (2) lack of a large number of ground truth for model-training to get high accuracy; (3) statically learning on graph which is not scalable. In this paper, we present Ringer, a scalable method to detect malicious domains by dynamic Graph Convolutional Network (GCN). Ringer first uses querying behaviors or domain-IP resolutions to construct domain graphs, on which the dynamic GCN is leveraged to learn the node representations that integrate both information about node features and graph structure. And then, these high-quality representations are further fed to the full-connected neural network for domain classification. Notably, instead of global statically learning, we adopt time-based hash to cut graphs to small ones and inductively learn the embedding of nodes according to selectively sampling neighbors. We construct a series of experiments on a large ISP over two days and compare it with state of the arts. The results demonstrate that Ringer achieves excellent performance with a high accuracy of 96.8% on average. Additionally, we find thousands of potential malicious domains by semi-supervised learning.

Malicious domains are key components to a variety of illicit online activities. We propose MalShoot, a graph embedding technique for detecting malicious domains using passive DNS database. We base its design on the intuition that a group of domains that share similar resolution information would have the same property, namely malicious or benign. MalShoot represents every domain as a low-dimensional vector according to its DNS resolution information. It automatically maps the domains that share similar resolution information to similar vectors while unrelated domains to distant vectors. Based on the vectorized representation of each domain, a machine-learning classifier is trained over a labeled dataset and is further applied to detect other malicious domains. We evaluate MalShoot using real-world DNS traffic collected from three ISP networks in China over two months. The experimental results show our approach can effectively detect malicious domains with a 96.08% true positive rate and a 0.1% false positive rate. Moreover, MalShoot scales well even in large datasets.

Person re-identification (person Re-ID) is mostly viewed as an image retrieval problem across different cameras. Most of existing models have achieved significant improvement on single-domain setting but failed to generalize to new domain due to the image style variations between domains. In this work, we aim to adapt a model trained on source domain to unlabeled target domain without significant performance drop. Thus, a novel style transfer framework that allows us to separate image style from content is proposed in Re-ID. Firstly, the source domain image is transferred to the target style while retaining the ID information. Then the source domain images and transferred images are combined to train a style-independent Re-ID model. Experiments show that we achieved higher performance of unsupervised cross-domain person Re-ID on the Market-1501 and DukeMTMC-reID datasets.

Domain names have been abused for illicit online activities for decades. A wealth of effort has been devoted to detect malicious domains in the past. However, these works primarily identify suspicious DNS behaviors (e.g., lookup patterns, resolution graphs) to distinguish legitimate domains from malicious ones. Whereas, these behaviors can only be observed after malicious activity is already underway, thus are often too late to prevent miscreants from reaping benefits of the attacks, delaying detection. In this paper, we propose MalHunter, a timely detection technique that determines a domain’s reputation via only a single DNS query. We base it on the insight that miscreants need to host malicious domains on IPs that they control, which makes different malicious domains are commonly hosted on the same IPs and creates intrinsic associations. To capture these inherent associations, we employ a deep neural network architecture based method, thus making it possible for detecting malicious domains via only a single DNS query. We evaluate MalHunter using real-world DNS traffic collected from three large ISP networks in China over two months. Compared to previous approaches, our method significantly reduces the time delay of detection from days or weeks to approximate ten microseconds while maintaining as high detection accuracy.

Protocol fingerprinting (PF) focuses on the capability to derive a series of distinguishable features for recognizing which protocol or application generated the network traffic. Unfortunately, deep packet inspection (DPI), a widely adopted method for PF, requires significant expert effort to develop and maintain protocol signatures. Additionally, the new solution paradigm, deep flow inspection (DFI) using machine learning for PF, also relies on hand-designed features. In this paper, we present ProNet, a payload based approach to protocol fingerprinting, which overcomes the limitation of artificial feature engineering. The key novelty of ProNet is two-fold: (i) it takes generic, raw short packet payloads as input, instead of the typical flow-statistical-features (e.g., port, packet size, packet-interval); (ii) it learns to simultaneously extract features via convolutional operations on the byte-level embeddings and ngram-level embeddings. We implement and evaluate ProNet on real-world traces, including DNS, QQLive, PPLive, PPStream, SopCast, DHCP, NBNS, HTTP, SMTP and SMB. Our experiment results show that ProNet achieves over 99% precision and recall with low false-positives (less than 1%) and nearly no false-negatives.

Malicious domains play a vital component in various cyber crimes. Most of the prior works depend on DNS A (address) records to detect the malicious domains, which are directly resolved to IP addresses. In this paper, we propose a malicious domain detection method focusing on the domains that are not resolved to IP addresses directly but only appear in DNS CNAME (canonical name) records. This kind of domains occupy 18.39% of the total domains in our 1530-days-long DNS traffic dataset collected from 217 DNS servers. In addition, the real-world dataset shows that domains connected with malicious ones through DNS CNAME records tend to be malicious too. Based on this observation, our proposal can identify the illegal domains by computing their maliciousness probabilities. The experiments demonstrate the high detection performance of our solution. It achieves the accuracy, on average, over 97.25% true positive rate with less than 0.027% false positive rate. Moreover, the proposal performs near real time detections. Our work can help network attack defenders to build a more robust domain monitoring system.

DNS tunnel is a typical Internet covert channel used by attackers or bots to evade the malicious activities detection. The stolen information is encoded and encapsulated into the DNS packets to transfer. Since DNS traffic is common, most of the firewalls directly allow it to pass and IDS does not trigger an alarm with it. The popular signature-based detection methods and threshold-based methods are not flexible and make high false alarms. The approaches based on characters distribution features also do not perform well, because attackers can modify the encoding method to disturb the characters distributions.In this paper, we propose an effective and applicable DNS tunnel detection mechanism. The prototype system is deployed at the Recursive DNS for tunnel identification. We use four kinds of features including time-interval features, request packet size features, record type features and subdomain entropy features. We evaluate the performance of our proposal with Support Vector Machine, Decision Tree and Logistical Regression. The experiments show that the method can achieve high detection accuracy of 99.96%.