Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic

Summary: Unit 42 researchers used an autoencoder built on recurrent neural network cells to compress DNS traffic time series into fixed-dimensional vectors called DNS profiles, training until validation loss stabilized after 5,000 epochs. The resulting detector captured 170 emerging suspicious domains in May 2024, and the signatures blocked approximately 374,000 malicious DNS requests per day through the Advanced DNS Security service.

What you should know: Roughly 374,000 blocked DNS requests a day is the volume of malicious resolution traffic one vendor's detector sees, and the case studies show why it hides: strategically aged domains like pococo[.]cc sit dormant for months, and typosquats like comcadt[.]net resolved to more than 50 malicious IPs across the United States and the Netherlands with a 10-minute TTL.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026