A Word-Level Analytical Approach for Identifying Malicious Domain Names Caused by Dictionary-Based DGA Malware

Abstract

Computer networks are facing serious threats from the emergence of malware with sophisticated DGAs (Domain Generation Algorithms). This type of DGA malware dynamically generates domain names by concatenating words from dictionaries for evading detection. In this paper, we propose an approach for identifying the callback communications of such dictionary-based DGA malware by analyzing their domain names at the word level. This approach is based on the following observations: These malware families use their own dictionaries and algorithms to generate domain names, and accordingly, the word usages of malware-generated domains are distinctly different from those of human-generated domains. Our evaluation indicates that the proposed approach is capable of achieving accuracy, recall, and precision as high as 0.9989, 0.9977, and 0.9869, respectively, when used with labeled datasets. We also clarify the functional differences between our approach and other published methods via qualitative comparisons. Taken together, these results suggest that malware-infected machines can be identified and removed from networks using DNS queries for detected malicious domain names as triggers. Our approach contributes to dramatically improving network security by providing a technique to address various types of malware encroachment.

A Deep learning framework for domain generation algorithm based malware detection

“…The character-level similarities between dynamically generated domain names and human-produced domain names were the key challenge to address; modelling based on these similarities is unlikely to be good enough to detect dict-DGA malware. As a result, [20] suggested a method for detecting fraudulent domain names at the word level by examining their character strings The goal of this work was to identify dynamically produced domains from huge DNS queries in order to detect dict-DGA malware callbacks.The suggested method, which consists of four steps. They are feature-vector based identification, word segmentation, noise reduction, and word graph generation.…”

“…Only analyze the character string behaviour [20] Word graph method This model takes longer computational time in large scale networks. [34] Behavior analysis The process is long time taking one.…”

A Malicious Domain Detection Model Based on Improved Deep Learning

“…e other is to use relevant algorithms such as neural networks in machine learning or their improved algorithms to realize the automatic extraction of character-level features of domain name data and subsequent analysis, processing, and discrimination [3][4][5].…”