A machine learning framework for domain generating algorithm based malware detection

Abstract

Real-time detection of domain names that are generated using the domain generating algorithms (DGA) is a challenging cyber security challenge. Traditional malware control methods, such as blacklisting, are insufficient to handle DGA threats. In this paper, a machine learning framework for identifying and detecting DGA domains is proposed to alleviate the threat. The proposed machine learning framework consists of a two-level model. In the two-level model, the DGA domains are classified apart from normal domains and then the clustering method is used to identify the algorithms that generate those DGA domains. K E Y W O R D S density-based spatial clustering of applications with noise, DGA, gradient boosting tree, J48, Jaccard-index, logistic regression, machine learning, malware, n-grams entropy ordering points to identify the clustering