Improved DGA Domain Names Detection and Categorization Using Deep Learning Architectures with Classical Machine Learning Algorithms

Ravi, Vinayakumar; Poornachandran, Prabaharan; Akarsh, S.; Elhoseny, Mohamed

doi:10.1007/978-3-030-16837-7_8

Cited by 15 publications

(10 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It can be observed that none of the methods compared includes the whole list of word-based DGAs analysed in this article, as stated in the Motivation section. In terms of accuracy, we can observe that most of the methods succeed to provide a remarkable accuracy in at least one of the families, with the exception of the work presented in [52]. Moreover, in many cases, the size of the samples evaluated is extremely small (i.e.…”

Section: Discussionmentioning

confidence: 96%

“…After a deeper analysis of the outcomes, we observed a common trend in most of them. More concretely, when a method can accurately detect a DGA family, it fails to detect others, due to the particular characteristics of each DGA, as seen in [51,8,14,57,52]. Note that there are cases where the method is not able to capture any instance of a DGA (i.e.…”

Section: Discussionmentioning

confidence: 99%

“…Their model runs in an end-to-end way and does not require from domain feature extraction, enhancing its performance. Vinayakumar et al [52] implemented a set of deep learning architectures with Keras Embedding and classical machine learning algorithms to classify DGA families. Their best reported configuration is obtained when using RNNs with SVM with radial basis function (SVM-RBF).…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Exploiting Statistical and Structural Features for the Detection of Domain Generation Algorithms

Patsakis,

Casino

2019

Preprint

View full text Add to dashboard Cite

Nowadays, malware campaigns have reached a high level of sophistication, thanks to the use of cryptography and covert communication channels over traditional protocols and services. In this regard, a typical approach to evade botnet identification and takedown mechanisms is the use of domain fluxing through the use of Domain Generation Algorithms (DGAs). These algorithms produce an overwhelming amount of domain names that the infected device tries to communicate with to find the Command and Control server, yet only a small fragment of them is actually registered. Due to the high number of domain names, the blacklisting approach is rendered useless. Therefore, the botmaster may pivot the control dynamically and hinder botnet detection mechanisms. To counter this problem, many security mechanisms result in solutions that try to identify domains from a DGA based on the randomness of their name.In this work, we explore hard to detect families of DGAs, as they are constructed to bypass these mechanisms. More precisely, they are based on the use of dictionaries so the domains seem to be user-generated. Therefore, the corresponding generated domains pass many filters that look for, e.g. high entropy strings. To address this challenge, we propose an accurate and efficient probabilistic approach to detect them. We test and validate the proposed solution through extensive experiments with a sound dataset containing all the wordlist-based DGA families that exhibit this behaviour and compare it with other state-of-the-art methods, practically showing the efficacy and prevalence of our proposal.

show abstract

Section: Discussionmentioning

confidence: 96%

Section: Discussionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Exploiting Statistical and Structural Features for the Detection of Domain Generation Algorithms

Patsakis,

Casino

2019

Preprint

View full text Add to dashboard Cite

show abstract

“…In [622] proposed LSTM architecture for DGA detection and as well as classification. This has performed well in both the tasks.In [609], The authors extracts the hidden layer features and fed it as input to many classical ML models for further learning. This type of learning approach can be called as transfer learning.…”

Section: A Deep Learning In Intrusion Detectionmentioning

confidence: 99%

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Ravi¹,

Alazab²,

Sriram³

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

“…Their model runs in an end-to-end fashion and does not require domain feature extraction. Vinayakumar et al [47] implemented a set of deep learning architectures with Keras embedding and classical machine learning algorithms to classify DGA families. Their best-reported configuration is obtained when using RNNs and SVM with a radial basis function (SVM-RBF).…”

Section: Introductionmentioning

confidence: 99%

Intercepting Hail Hydra: Real-Time Detection of Algorithmically Generated Domains

Casino,

Lykousas,

Homoliak

et al. 2020

Preprint

View full text Add to dashboard Cite

A crucial technical challenge for cybercriminals is to keep control over the potentially millions of infected devices that build up their botnets, without compromising the robustness of their attacks. A single, fixed C&C server, for example, can be trivially detected either by binary or traffic analysis and immediately sink-holed or taken-down by security researchers or law enforcement. Botnets often use Domain Generation Algorithms (DGAs), primarily to evade take-down mechanisms. DGAs enlarge the lifespan of a malware campaign, thus enhancing its profitability. They can also contribute to hardening attack attribution. In this work, we introduce HYDRA the most comprehensive and complete available dataset of Algorithmically-Generated Domains (AGD). The dataset contains more than 100 DGA families, including both real-world and adversarial ones. We analyse the dataset and discuss the possibility of differentiating between benign requests (to real domains) and malicious ones (to AGDs) in real-time. The simultaneous study of so many families and variants introduces several challenges; nonetheless, it alleviates biases found in previous literature that deals with small datasets and exploit some characteristic features of particular families. To this end, we thoroughly compare our approach with the current state-of-the-art and highlight some methodological shortcomings in the actual state of practice. The outcomes obtained show that our method significantly outperforms the current state-of-the-art in terms of both accuracy and efficiency.

show abstract

Improved DGA Domain Names Detection and Categorization Using Deep Learning Architectures with Classical Machine Learning Algorithms

Cited by 15 publications

References 33 publications

Exploiting Statistical and Structural Features for the Detection of Domain Generation Algorithms

Exploiting Statistical and Structural Features for the Detection of Domain Generation Algorithms

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Intercepting Hail Hydra: Real-Time Detection of Algorithmically Generated Domains

Contact Info

Product

Resources

About