Predicting Domain Generation Algorithms with Long Short-Term Memory Networks

Abstract

Various families of malware use domain generation algorithms (DGAs) to generate a large number of pseudo-random domain names to connect to a command and control (C&C) server. In order to block DGA C&C traffic, security organizations must first discover the algorithm by reverse engineering malware samples, then generating a list of domains for a given seed. The domains are then either preregistered or published in a DNS blacklist. This process is not only tedious, but can be readily circumvented by malware authors using a large number of seeds in algorithms with multivariate recurrence properties (e.g., banjori) or by using a dynamic list of seeds (e.g., bedep). Another technique to stop malware from using DGAs is to intercept DNS queries on a network and predict whether domains are DGA generated. Such a technique will alert network administrators to the presence of malware on their networks. In addition, if the predictor can also accurately predict the family of DGAs, then network administrators can also be alerted to the type of malware that is on their networks. This paper presents a DGA classifier that leverages long short-term memory (LSTM) networks to predict DGAs and their respective families without the need for a priori feature extraction. Results are significantly better than state-of-the-art techniques, providing 0.9993 area under the receiver operating characteristic curve for binary classification and a micro-averaged F1 score of 0.9906. In other terms, the LSTM technique can provide a 90% detection rate with a 1:10000 false positive (FP) rate---a twenty times FP improvement over comparable methods. Experiments in this paper are run on open datasets and code snippets are provided to reproduce the results.

References in corpus (2)

• Sequence Transduction with Recurrent Neural Networks
• Visualizing and Understanding Recurrent Networks

Cited by in corpus (21)

• A Survey on Malicious Domains Detection through DNS Data Analysis
• Automatic Detection of Malware-Generated Domains with Recurrent Neural Models
• Inline Detection of Domain Generation Algorithms with Context-Sensitive Word Embeddings
• Machine Learning in Cyber-Security - Problems, Challenges and Data Sets
• Analyzing the Real-World Applicability of DGA Classifiers
• Intercepting Hail Hydra: Real-Time Detection of Algorithmically Generated Domains
• MaskDGA: A Black-box Evasion Technique Against DGA Classifiers and Adversarial Defenses
• Finding Phish in a Haystack: A Pipeline for Phishing Classification on Certificate Transparency Logs
• A short review on Applications of Deep learning for Cyber security
• Making Use of NXt to Nothing: The Effect of Class Imbalances on DGA Detection Classifiers
• False Sense of Security: Leveraging XAI to Analyze the Reasoning and True Performance of Context-less DGA Classifiers
• The More, the Better? A Study on Collaborative Machine Learning for DGA Detection
• HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification
• Nested Multiple Instance Learning in Modelling of HTTP network traffic
• Towards Robust Domain Generation Algorithm Classification
• An AI-based, Multi-stage detection system of banking botnets
• Detecting Unknown DGAs without Context Information
• DomainGAN: Generating Adversarial Examples to Attack Domain Generation Algorithm Classifiers
• Artificial Neural Network for Cybersecurity: A Comprehensive Review
• Deep Learning based Frameworks for Handling Imbalance in DGA, Email, and URL Data Analysis
• A compression based framework for the detection of anomalies in heterogeneous data sources