A DGA domain names detection modeling method based on integrating an attention mechanism and deep neural network

Abstract

Command and control (C2) servers are used by attackers to operate communications. To perform attacks, attackers usually employee the Domain Generation Algorithm (DGA), with which to confirm rendezvous points to their C2 servers by generating various network locations. The detection of DGA domain names is one of the important technologies for command and control communication detection. Considering the randomness of the DGA domain names, recent research in DGA detection applyed machine learning methods based on features extracting and deep learning architectures to classify domain names. However, these methods are insufficient to handle wordlist-based DGA threats, which generate domain names by randomly concatenating dictionary words according to a special set of rules. In this paper, we proposed a a deep learning framework ATT-CNN-BiLSTM for identifying and detecting DGA domains to alleviate the threat. Firstly, the Convolutional Neural Network (CNN) and bidirectional Long Short-Term Memory (BiLSTM) neural network layer was used to extract the features of the domain sequences information; secondly, the attention layer was used to allocate the corresponding weight of the extracted deep information from the domain names. Finally, the different weights of features in domain names were put into the output layer to complete the tasks of detection and classification. Our extensive experimental results demonstrate the effectiveness of the proposed model, both on regular DGA domains and DGA that hard to detect such as wordlist-based and part-wordlist-based ones. To be precise,we got a F1 score of 98.79% for the detection and macro average precision and recall of 83% for the classification task of DGA domain names.

Detection of Algorithmically Generated Domain Names Using the Recurrent Convolutional Neural Network with Spatial Pyramid Pooling

“…The experiments demonstrate that our model achieves perfect performance. Future work will consider the optimization of its performance and compare it with the recent work [ 37 , 38 , 39 ] to evaluate the strength of the model.…”

Detection of DGA-Generated Domain Names with TF-IDF

“…The following subsections provide more details on the ML models in Section 3.1, on the DL models in Section 3.2, on other methods in Section 3.3, and on the datasets used in the reviewed studies in Section 3.4. [37] RNN Alexa/DGArchive (63 DGAs), Bambenek (11 DGAs) Koh and Rhodes [38] LSTM OpenDNS/Bader, Abakumov Tran et al [39] LSTM.MI Alexa/Bambenek (37 DGAs) Vinayakumar et al [40] LSTM, GRU, IRNN, RNN, CNN, hybrid (CNN-LSTM) Alexa, OpenDNS/Bambenek, Bader (17 DGAs) Xu et al [41] CNN-based Alexa/DGArchive (16 DGAs) Yu et al [42] LSTM, BiLSTM, stacked CNN, parallel CNN, hybrid (CNN-LSTM) Alexa/Bambenek Akarsh et al [43] LSTM OpenDNS, Alexa/20 public DGAs Qiao et al [44] LSTM Alexa/Bambenek Liu et al [45] Hybrid (BiLSTM-CNN) Alexa/Netlab (50 DGAs), Bambenek (30 DGAs) Ren et al [46] CNN, LSTM, CNN-BiLSTM, ATT-CNN-BiLSTM, SVM Alexa/Bambenek, Netlab (19 DGAs) Sivaguru et al [31] hybrid (RF-LSTM.MI) Alexa, private/DGArchive Vij et al [47] LSTM Alexa/11 DGAs Cucchiarelli et al [34] BiLSTM, LSTM.MI, hybrid (CNN-BiLSTM) Alexa/Netlab (25 DGAs) Highnam et al [48] hybrid (CNN-LSTM-ANN) Alexa/DGArchive (3 DGAs) Namgung et al [49] CNN, LSTM, BiLSTM, hybrid (CNN-BiLSTM) Alexa/Bambenek Yilmaz et al [50] LSTM Majestic/DGArchive (68 DGAs) [53] 2020 Alexa/various Yan et al [54] 2020 Passive DNS data/public blacklists Yin et al [55] 2020 Alexa/Bader (19 DGAs)…”

Improved Detection of Malicious Domain Names Using Gradient Boosted Machines and Feature Engineering

“…The detection of DGA domains has gotten a lot of interest in recent years. This is a challenging task due to the ability of DGA domains to overcome blacklist filtration [31]. The features identified as influential in detection malicious domains are extracted from DGA domains.…”