AbuSayed1/DGA-Meta-Llama-3-8B-FineTunnedModel

Llama3 8B Fine-Tuned for Domain Generation Algorithm Detection

This model is a fine-tuned adaptation of Meta's Llama3 8B, tailored for detecting Domain Generation Algorithms (DGAs). DGAs, commonly employed by malware, generate dynamic domain names for command-and-control (C&C) servers, posing a significant challenge in cybersecurity.

Model Description

• Base Model: Llama3 8B
• Task: DGA Detection
• Fine-Tuning Approach: Qlora based supervised Fine-Tuning (SFT) with domain-specific data.
• Dataset: A combined dataset comprising 59 malware families and legitimate domains consisting of three different sources: one dataset for benign domains, which includes the Alexa Top 1 Million Sites collection of reputable domains; and two datasets for DGA domains, sourced from Bambenek Consulting’s malicious algorithmically-generated domains and the 360 Lab DGA Domains.
• Performance:
  • Accuracy: Known domain 98.6%, Unknown domain 80-99.5%
  • Excels in detecting unknown DGAs.

This model leverages the extensive semantic understanding of Llama3 to classify domains as either malicious (DGA-generated) or legitimate with high precision and recall.

Data

The model was trained with 2.5 million domains, split between 1.5 million DGA domains and 1 million normal domains.

Dataset Link: https://huggingface.co/datasets/AbuSayed1/DGA-DATASET

The GitHub repository https://github.com/MDABUSAYED/StratosphereLinuxIPS/tree/LLM/modules/flowalerts/LLM describe how the model was trained and evaluated.

Citation

APA:

Sayed, M. A., Rahman, A., Kiekintveld, C., & Garcia, S. (2024). Fine-tuning Large Language Models for DGA and DNS Exfiltration Detection. arXiv preprint arXiv:2410.21723.