2018/10/03 by Ryan R. Curtin, Andrew B. Gardner, Curtin, Ryan R. +7
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Network Security and Intrusion Detection
paper · pdf · doi:10.48550/arxiv.1810.02023
openalex publication_date 2018/10/03 · openalex created_date 2022/08/02 · openalex updated_date 2026/07/28
Modern malware typically makes use of a domain generation algorithm (DGA) to\navoid command and control domains or IPs being seized or sinkholed. This means\nthat an infected system may attempt to access many domains in an attempt to\ncontact the command and control server. Therefore, the automatic detection of\nDGA domains is an important task, both for the sake of blocking malicious\ndomains and identifying compromised hosts. However, many DGAs use English\nwordlists to generate plausibly clean-looking domain names; this makes\nautomatic detection difficult. In this work, we devise a notion of difficulty\nfor DGA families called the smashword score; this measures how much a DGA\nfamily looks like English words. We find that this measure accurately reflects\nhow much a DGA family's domains look like they are made from natural English\nwords. We then describe our new modeling approach, which is a combination of a\nnovel recurrent neural network architecture with domain registration side\ninformation. Our experiments show the model is capable of effectively\nidentifying domains generated by difficult DGA families. Our experiments also\nshow that our model outperforms existing approaches, and is able to reliably\ndetect difficult DGA families such as matsnu, suppobox, rovnix, and others. The\nmodel's performance compared to the state of the art is best for DGA families\nthat resemble English words. We believe that this model could either be used in\na standalone DGA domain detector---such as an endpoint security\napplication---or alternately the model could be used as a part of a larger\nmalware detection system.\n