Automatic Detection of Malware-Generated Domains with Recurrent Neural Models
arXiv:1709.07102
Abstract
Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F_1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.
arXiv commentSubmitted to NISK 2017
References in corpus (3)
Cited by in corpus (9)
- Inline Detection of Domain Generation Algorithms with Context-Sensitive Word Embeddings
- Intercepting Hail Hydra: Real-Time Detection of Algorithmically Generated Domains
- A short review on Applications of Deep learning for Cyber security
- Making Use of NXt to Nothing: The Effect of Class Imbalances on DGA Detection Classifiers
- HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification
- The Agent Web Model -- Modelling web hacking for reinforcement learning
- Artificial Neural Network for Cybersecurity: A Comprehensive Review
- Deep Learning based Frameworks for Handling Imbalance in DGA, Email, and URL Data Analysis
- A compression based framework for the detection of anomalies in heterogeneous data sources