Joint Detection of Malicious Domains and Infected Clients
  Detection of malware-infected computers and detection of malicious web
domains based on their encrypted HTTPS traffic are challenging problems,
because only addresses, timestamps, and data volumes are observable. The
detection problems are coupled, because infected clients tend to interact with
malicious domains. Traffic data can be collected at a large scale, and
antivirus tools can be used to identify infected clients in retrospect.
Domains, by contrast, have to be labeled individually after forensic analysis.
We explore transfer learning based on sluice networks; this allows the
detection models to bootstrap each other. In a large-scale experimental study,
we find that the model outperforms known reference models and detects
previously unknown malware, previously unknown malware families, and previously
unknown malicious domains.
