Detecting Word-Based Algorithmically Generated Domains Using Semantic Analysis

Abstract

In highly sophisticated network attacks, command-and-control (C&C) servers always use domain generation algorithms (DGAs) to dynamically produce several candidate domains instead of static hard-coded lists of IP addresses or domain names. Distinguishing the domains generated by DGAs from the legitimate ones is critical for finding out the existence of malware or further locating the hidden attackers. The word-based DGAs disclosed in recent network attack events have shown significantly stronger stealthiness when compared with traditional character-based DGAs. In word-based DGAs, two or more words are randomly chosen from one or more specific dictionaries to form a dynamic domain, these regularly generated domains aim to mimic the characteristics of a legitimate domain. Existing DGA detection schemes, including the state-of-the-art one based on deep learning, still cannot find out these domains accurately while maintaining an acceptable false alarm rate. In this study, we exploit the inter-word and inter-domain correlations using semantic analysis approaches, word embedding and the part-of-speech are taken into consideration. Next, we propose a detection framework for word-based DGAs by incorporating the frequency distribution of the words and that of part-of-speech into the design of the feature set. Using an ensemble classifier constructed from Naive Bayes, Extra-Trees, and Logistic Regression, we benchmark the proposed scheme with malicious and legitimate domain samples extracted from public datasets. The experimental results show that the proposed scheme can achieve significantly higher detection accuracy for word-based DGAs when compared with three state-of-the-art DGA detection schemes.

Detecting Multielement Algorithmically Generated Domain Names Based on Adaptive Embedding Model

“…Schales et al [14] performed detection by extracting 17 domain name features combined with four of weighted confidence and verified the effectiveness of the algorithm in a large-scale network environment. Yang et al [15] proposed a word semantic analysis method for word-based domain names to detect malicious domain names by the correlation between words in them. e drawback of feature-based detection algorithms is that they rely on manual feature analysis capabilities, and the dimensionality of character-level features is limited.…”

“…e segmentation method used in step 1 is the bidirectional maximum matching algorithm [15]. A unique parsing result T s ′ � e 1 , e 2 , .…”

Artificial Intelligence in the Cyber Domain: Offense and Defense

“…Another approach in [59], proposed a framework for identification word-based DGAs by utilizing the frequency distribution of the words and an ensemble classifier constructed from naive Bayes, extra-trees, and logistic regression. The authors reported that their method outperformed the comparable ones.…”

Detection of Algorithmically Generated Domain Names Using the Recurrent Convolutional Neural Network with Spatial Pyramid Pooling

“…Yang et al. [ 19 ] analyzed several types of features including word frequency, parts-of-speech, inter-word correlation, and inter-domain correlations by bi-directional maximum matching and then built an ensemble classifier to identify algorithmically generated domain names. Li et al.…”