.png){kind=icon}
.png){kind=icon}
Return
Machine learning-based algorithmically generated domain detection?
.png){kind=icon}
PRE
AI
DOI：10.1016/j.compeleceng.2022.107841.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Malware like botnets typically uses domain generation algorithms (DGAs) to dynamically produce a large number of random algorithmically generated domains (AGDs) and use a few of them to communicate with the command and control servers. AGD detection provides a lightweight yet effective solution to the threats imposed by DGA-based malware. For example, the linguistic distance between domain names was found as the promising metric to identify AGDs from benign domains. However, the distance metrics are not informatively enough used by the conventional approach. We propose to use machine learning algorithms on the distance metrics. Feature engineering techniques are proposed to boost detection performance. The results show that our proposal can outperform the existing algorithms, with a detection accuracy of over 99% for the tested DGAs. The permutation feature importance analysis is presented for explainability. The deployment locations of the AGD detectors are discussed.
Keywords:
Domain generation algorithm
Malware detection
Machine learning
Feature engineering
Classification
Journal
C
IF:
4.9
Papers:
6.7K
Citations:
1.3W