Analyzing the Real-World Applicability of DGA Classifiers

Abstract

Separating benign domains from domains generated by DGAs with the help of a binary classifier is a well-studied problem for which promising performance results have been published. The corresponding multiclass task of determining the exact DGA that generated a domain enabling targeted remediation measures is less well studied. Selecting the most promising classifier for these tasks in practice raises a number of questions that have not been addressed in prior work so far. These include the questions on which traffic to train in which network and when, just as well as how to assess robustness against adversarial attacks. Moreover, it is unclear which features lead a classifier to a decision and whether the classifiers are real-time capable. In this paper, we address these issues and thus contribute to bringing DGA detection classifiers closer to practical use. In this context, we propose one novel classifier based on residual neural networks for each of the two tasks and extensively evaluate them as well as previously proposed classifiers in a unified setting. We not only evaluate their classification performance but also compare them with respect to explainability, robustness, and training and classification speed. Finally, we show that our newly proposed binary classifier generalizes well to other networks, is time-robust, and able to identify previously unknown DGAs.

Accepted at The 15th International Conference on Availability, Reliability and Security (ARES 2020)

References in corpus (5)

• cuDNN: Efficient Primitives for Deep Learning
• Predicting Domain Generation Algorithms with Long Short-Term Memory Networks
• eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys
• DeepDGA: Adversarially-Tuned Domain Generation and Detection
• MaskDGA: A Black-box Evasion Technique Against DGA Classifiers and Adversarial Defenses

Cited by in corpus (5)

• Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
• Finding Phish in a Haystack: A Pipeline for Phishing Classification on Certificate Transparency Logs
• Making Use of NXt to Nothing: The Effect of Class Imbalances on DGA Detection Classifiers
• The More, the Better? A Study on Collaborative Machine Learning for DGA Detection
• Detecting Unknown DGAs without Context Information