Domain generation algorithms detection with feature extraction and Domain Center construction

Abstract

Network attacks using Command and Control (C&C) servers have increased significantly. To hide their C&C servers, attackers often use Domain Generation Algorithms (DGA), which automatically generate domain names for C&C servers. Researchers have constructed many unique feature sets and detected DGA domains through machine learning or deep learning models. However, due to the limited features contained in the domain name, the DGA detection results are limited. In order to overcome this problem, the domain name features, the Whois features and the N-gram features are extracted for DGA detection. To obtain the N-gram features, the domain name whitelist and blacklist substring feature sets are constructed. In addition, a deep learning model based on BiLSTM, Attention and CNN is constructed. Additionally, the Domain Center is constructed for fast classification of domain names. Multiple comparative experiment results prove that the proposed model not only gets the best Accuracy, Precision, Recall and F1, but also greatly reduces the detection time.

Deep learning DGA malicious domain name detection based on multi-stage feature fusion

“…Yang Cheng and others [11] introduced a malicious domain detection method based on n-gram and Transformer, which adds start and end markers to domain data, segments them into word group elements using the n-gram algorithm, and then transforms them into vectors for input into the Transformer model. Sun and others [12] constructed a deep learning model based on BiLSTM, Attention, and CNN, employing feature extraction and dimension reduction techniques, as well as a method based on centrality construction to identify DGA domains.…”

“…In this section, four models were selected for comparison: LSTM [9], HDNN [16], CNN-BiLSTM [17], and FEDCC [12]. Using the same experimental setup and dataset, comparative experiments were conducted with the CT_B model proposed in this study.…”