A Superficial Analysis Approach for Identifying Malicious Domain Names Generated by DGA Malware

Satoh, Akihiro; Fukuda, Yutaka; Hayashi, Tomoki; Kobashi, Gén

doi:10.1109/ojcoms.2020.3038704

Cited by 9 publications

(5 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Satoh et al [52] filter benign domain names using whitelists, select the longest subdomain and split it into words using dictionaries, and estimate the randomness of character strings. To compensate for deficiencies of the dictionaries, they also estimate the randomness of a subdomain by referring to web search results.…”

Section: Other Methodsmentioning

confidence: 99%

Detection of DGA-Generated Domain Names with TF-IDF

Vranken

Alizadeh

2022

Electronics

View full text Add to dashboard Cite

Botnets often apply domain name generation algorithms (DGAs) to evade detection by generating large numbers of pseudo-random domain names of which only few are registered by cybercriminals. In this paper, we address how DGA-generated domain names can be detected by means of machine learning and deep learning. We first present an extensive literature review on recent prior work in which machine learning and deep learning have been applied for detecting DGA-generated domain names. We observe that a common methodology is still missing, and the use of different datasets causes that experimental results can hardly be compared. We next propose the use of TF-IDF to measure frequencies of the most relevant n-grams in domain names, and use these as features in learning algorithms. We perform experiments with various machine-learning and deep-learning models using TF-IDF features, of which a deep MLP model yields the best results. For comparison, we also apply an LSTM model with embedding layer to convert domain names from a sequence of characters into a vector representation. The performance of our LSTM and MLP models is rather similar, achieving 0.994 and 0.995 AUC, and average F1-scores of 0.907 and 0.891 respectively.

show abstract

Section: Other Methodsmentioning

confidence: 99%

Detection of DGA-Generated Domain Names with TF-IDF

Vranken

Alizadeh

2022

Electronics

View full text Add to dashboard Cite

show abstract

“…A Superficial Analysis Approach is proposed for estimating the randomness of domain names by superficially analyzing their character strings in [19] .The following observations underpin this strategy: The goal of humangenerated benign domain names, such as an organisation, product, or material, tends to reflect the intent of their domain registrants. Because conflicts with existing registered domain names must be avoided, dynamically created harmful domain names consist of nonsensical character strings; thus, there are observable discrepancies in the strings of dynamically generated and human-made domain names.Previous research have recommended for the use of randomization to aid malware detection, however this approach distinguishes between benign and malicious domains using simply the character string of the domain name and does not require any prior knowledge of DGAs.This strategy's unique features have secured three tiers of effectiveness.…”

Section: Literature Surveymentioning

confidence: 99%

A Deep learning framework for domain generation algorithm based malware detection

Abhiram

Anver

Rahiman³

2023

Preprint

View full text Add to dashboard Cite

Command and control server, also known as C2 or C&C related cyberat-tacks have sharply grown in recent years. Attackers typically use a domain generating algorithm (DGA) to generate domain names in a random fashion for their C&C servers automatically. As a result, a thorough investigation into the identification of DGA domains has been conducted. On the other side, a lot of anti-malware programmes rely on network whitelisting, hashing, or static string verification. These strategies are fundamental for usage with those risky malware attacks, which can conceal their existence and employ various techniques to evade detection. A two-level model makes up the suggested deep learning framework. First, features from the domain names are generated using a feature generator. Next, DGA domains are distinguished from other domain types, and last, the clustering phase is utilised to pinpoint the type of those DGA domains. This paper demonstrates how the suggested system can efficiently extract the attributes from the domain names, as well as group, categorise, and detect harmful domains with more precision. When compared to other models, the proposed model performs better.

show abstract

“…Cybercrime is predicted to skyrocket to become over $23.8 Trillion industry by 2027 [1]. A hack attack occurs every 39 seconds, and about 300,000 new malwares are created daily [2]. By 2025, ~75 billion devices will be connected to the Internet [3].…”

Section: Introductionmentioning

confidence: 99%

From Standard Policy-Based Zero Trust to Absolute Zero Trust (AZT): A Quantum Leap to Q-Day Security

Raheman

2024

JCC

View full text Add to dashboard Cite

Cybercrime is projected to cost a whopping $23.8 Trillion by 2027. This is essentially because there's no computer network that's not vulnerable. Fool-proof cybersecurity of personal data in a connected computer is considered practically impossible. The advent of quantum computers (QC) will worsen cybersecurity. QC will be a boon for data-intensive industries by drastically reducing the computing time from years to minutes. But QC will render our current cryptography vulnerable to quantum attacks, breaking nearly all modern cryptographic systems. Before QCs with sufficient qubits arrive, we must be ready with quantum-safe strategies to protect our ICT infrastructures. Postquantum cryptography (PQC) is being aggressively pursued worldwide as a defence from the potential Q-day threat. NIST (National Institute of Standards and Technology), in a rigorous process, tested 82 PQC schemes, 80 of which failed after the final round in 2022. Recently the remaining two PQCs were also cracked by a Swedish and a French team of cryptographers, placing NIST's PQC standardization process in serious jeopardy. With all the NISTevaluated PQCs failing, there's an urgent need to explore alternate strategies. Although cybersecurity heavily relies on cryptography, recent evidence indicates that it can indeed transcend beyond encryption using Zero Vulnerability Computing (ZVC) technology. ZVC is an encryption-agnostic absolute zero trust (AZT) approach that can potentially render computers quantum resistant by banning all third-party permissions, a root cause of most vulnerabilities. Unachievable in legacy systems, AZT is pursued by an experienced consortium of European partners to build compact, solid-state devices that are robust, resilient, energy-efficient, and with zero attack surface, rendering them resistant to malware and future Q-Day threats.How to cite this paper: Raheman, F.

show abstract

A Superficial Analysis Approach for Identifying Malicious Domain Names Generated by DGA Malware

Cited by 9 publications

References 38 publications

Detection of DGA-Generated Domain Names with TF-IDF

Detection of DGA-Generated Domain Names with TF-IDF

A Deep learning framework for domain generation algorithm based malware detection

From Standard Policy-Based Zero Trust to Absolute Zero Trust (AZT): A Quantum Leap to Q-Day Security

Contact Info

Product

Resources

About