.png){kind=icon}
Return
PKDGA: A Partial Knowledge-Based Domain Generation Algorithm for Botnets
.png){kind=icon}
OA
AI
DOI：10.1109/TIFS.2023.3298229.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Domain generation algorithms (DGAs) can be categorized into three types: zero-knowledge, partial-knowledge, and full-knowledge. While prior research merely focused on zero-knowledge and full-knowledge types, we characterize their anti-detection ability and practicality and find that zero-knowledge DGAs present low anti-detection ability against detectors, and full-knowledge DGAs suffer from low practicality due to the strong assumption that they are fully detector-aware. Given these observations, we propose PKDGA, a partial knowledge-based domain generation algorithm with high anti-detection ability and high practicality. PKDGA employs the reinforcement learning architecture, which makes it evolve automatically based only on the easily-observable feedback from detectors. We evaluate PKDGA using a comprehensive set of real-world datasets, and the results demonstrate that it reduces the detection performance of existing detectors from 91.7% to 52.5%. We further apply PKDGA to the Mirai malware, and the evaluations show that the proposed method is quite lightweight and time-efficient.
Keywords:
Detectors
Chatbots
Servers
Botnet
IP networks
Feature extraction
Registers
Domain generation algorithms
botnet networks
reinforcement learning
Journal
IF:
8
Papers:
5.2K
Citations:
2.3W
Organization
Cited Papers
ShareSaveShareSave
THE MEANING AND USE OF THE AREA UNDER A RECEIVER OPERATING CHARACTERISTIC (ROC) CURVE.png)
RADIOLOGY
RADIOLOGYIF15.2
PREAI
ShareSave
View more