Scalable detection of botnets based on DGA

Zago, Mattia; Pérez, Manuel Gil; Pérez, Gregorio Martínez

doi:10.1007/s00500-018-03703-8

Cited by 20 publications

(16 citation statements)

References 50 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The three algorithms have near matches to features studied by Zago et al [45]. One difference is in our definition of DGA behavior, restricting the string tested to the effective SLD.…”

Section: Implementation Of Algorithmsmentioning

confidence: 56%

“…We searched for a systematic review of the DGADA literature, 1 and mostly found recent machine learning approaches to malicious domain detection in general [48] and DGA detection using any methods (not just limited to orthography) [45]. Our focus is more narrow than these surveys, but they do provide some useful context and references.…”

Section: Domain Generation Algorithmmentioning

confidence: 99%

“…Zago et al [45] provides a feature analysis of machine-learning-based DGADA. Their results inform Section 3.2.…”

Section: Domain Generation Algorithmmentioning

confidence: 99%

“…Their results inform Section 3.2. There are some shortcomings in Reference [45]. For example, they do not distinguish second-level domain from effective second-level domain, as we do using the usual method of the public suffix list [24].…”

Section: Domain Generation Algorithmmentioning

confidence: 99%

“…They also do not specify a reference value for character frequency or ratios. Although we do not exhaustively improve the description and implementation of the features identified by Reference [45], we are able to take some of the more promising ones and better contextualize and ground them.…”

Section: Domain Generation Algorithmmentioning

confidence: 99%

See 4 more Smart Citations

The Ecosystem of Detection and Blocklisting of Domain Generation

Metcalf

Spring

2021

Digital Threats

View full text Add to dashboard Cite

Malware authors use domain generation algorithms to establish more reliable communication methods that can avoid reactive defender blocklisting techniques. Network defense has sought to supplement blocklists with methods for detecting machine-generated domains. We present a repeatable evaluation and comparison of the available open source detection methods. We designed our evaluation with multiple interrelated aspects, to improve both interpretability and realism. In addition to evaluating detection methods, we assess the impact of the domain generation ecosystem on prior results about the nature of blocklists and how they are maintained. The results of the evaluation of open source detection methods finds all methods are inadequate for practical use. The results of the blocklist impact study finds that generated domains decrease the overlap among blocklists; however, while the effect is large in relative terms, the baseline is so small that the core conclusions of the prior work are sustained. Namely, that blocklist construction is very targeted, context-specific, and as a result blocklists do no overlap much. We recommend that Domain Generation Algorithm detection should also be similarly narrowly targeted to specific algorithms and specific malware families, rather than attempting to create general-purpose detection for machine-generated domains.

show abstract

“…The three algorithms have near matches to features studied by Zago et al [45]. One difference is in our definition of DGA behavior, restricting the string tested to the effective SLD.…”

Section: Implementation Of Algorithmsmentioning

confidence: 56%

Section: Domain Generation Algorithmmentioning

confidence: 99%

“…Zago et al [45] provides a feature analysis of machine-learning-based DGADA. Their results inform Section 3.2.…”

Section: Domain Generation Algorithmmentioning

confidence: 99%

Section: Domain Generation Algorithmmentioning

confidence: 99%

Section: Domain Generation Algorithmmentioning

confidence: 99%

See 3 more Smart Citations