On the security of machine learning in malware C&C detection: a survey

Joseph Gardiner, Shishir Nagaraja

Research output: Contribution to journalArticlepeer-review

75 Citations (Scopus)
16 Downloads (Pure)


One of the main challenges in security today is defending against malware attacks. As trends and anecdotal evidence show, preventing these attacks, regardless of their indiscriminate or targeted nature, has proven difficult: intrusions happen and devices get compromised, even at security-conscious organizations. As a consequence, an alternative line of work has focused on detecting and disrupting the individual steps that follow an initial compromise and are essential for the successful progression of the attack. In particular, several approaches and techniques have been proposed to identify the command and control (C&C) channel that a compromised system establishes to communicate with its controller. A major oversight of many of these detection techniques is the design's resilience to evasion attempts by the well-motivated attacker. C&C detection techniques make widespread use of a machine learning (ML) component. Therefore, to analyze the evasion resilience of these detection techniques, we first systematize works in the field of C&C detection and then, using existing models from the literature, go on to systematize attacks against the ML components used in these approaches. © 2016 ACM 0360-0300/2016/12-ART59 $15.00.
Original languageEnglish
Article number59
Number of pages38
JournalACM Computing Surveys
Issue number3
Publication statusPublished - 31 Dec 2016


  • botnets
  • command and control channels
  • data mining
  • machine learning
  • network intrusion
  • artificial intelligence


Dive into the research topics of 'On the security of machine learning in malware C&C detection: a survey'. Together they form a unique fingerprint.

Cite this