Detecting DGA domains with recurrent neural networks and side information

Abstract

Modern malware typically makes use of a domain generation algorithm (DGA) to avoid command and control domains or IPs being seized or sinkholed. This means that an infected system may attempt to access many domains in an attempt to contact the command and control server. Therefore, the automatic detection of DGA domains is an important task, both for the sake of blocking malicious domains and identifying compromised hosts. However, many DGAs use English wordlists to generate plausibly clean-looking domain names; this makes automatic detection difficult. In this work, we devise a notion of difficulty for DGA families called the smashword score; this measures how much a DGA family looks like English words. We find that this measure accurately reflects how much a DGA family's domains look like they are made from natural English words. We then describe our new modeling approach, which is a combination of a novel recurrent neural network architecture with domain registration side information. Our experiments show the model is capable of effectively identifying domains generated by difficult DGA families. Our experiments also show that our model outperforms existing approaches, and is able to reliably detect difficult DGA families such as matsnu, suppobox, rovnix, and others. The model's performance compared to the state of the art is best for DGA families that resemble English words. We believe that this model could either be used in a standalone DGA domain detector-such as an endpoint security application-or alternately the model could be used as a part of a larger malware detection system. CCS CONCEPTS• Security and privacy → Malware and its mitigation; Artificial immune systems; Web protocol security; • Computing methodologies → Neural networks.

Encrypted and covert DNS queries for botnets: Challenges and countermeasures

“…In the case of [31], the authors are able to characterize and classify similar DGA-generated domains, generating knowledge about the evolving behaviour of botnets. More recently, Curtin et al developed the smashword score [32], a new metric that uses n-gram overlapping combined with information provided from WHOIS lookups to determine whether a DGA has generated a domain name or not. For a detailed overview and classification of methods of how malicious domains can be detected, the interested reader may refer to [33].…”

Artificial Intelligence in the Cyber Domain: Offense and Defense

“…According to the authors, the model could detect 97.3% of malware-generated domain names with a low false positive rate. Curtin et al [55] also took a similar approach using the generalized likelihood ratio test (GLRT) and achieved promising results.…”

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…The results show that DL models perform well when compared to ML models and LSTM achieves the highest detection accuracy. In [568], a RNN based robust DGA detection system which takes advantage of additional WHOIS information if available to enhance the performance of the system and to classify much more difficult DGA families. A novel measure called smashword score is also proposed which ranks DGAs based on how close the domains resemble English words.…”