DGA Domain Name Classification Method Based on Long Short-Term Memory with Attention Mechanism
Source abstract
Abstract
Currently, many cyberattacks use the Domain Generation Algorithm (DGA) to generate random domain names, so as to maintain communication with the Communication and Control (C&C) server. Discovering DGA domain names in advance could help to detect attacks and response in time. However, in recent years, the General Data Protection Regulation (GDPR) has been promulgated and implemented, and the method of DGA classification based on the context information, such as the WHOIS (the information about the registered users or assignees of the domain name), is no longer applicable. At the same time, acquiring the DGA algorithm by reversing malware samples encounters the problem of no malware samples for various reasons, such as fileless malware. We propose a DGA domain name classification method based on Long Short-Term Memory (LSTM) with attention mechanism. This method is oriented to the character sequence of the domain name, and it uses the LSTM combined with attention mechanism to construct the DGA domain name classifier to achieve the rapid classification of domain names. The experimental results show that the method has a good classification result.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Spam and Phishing Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Cyberspace Security Research Center, Peng Cheng Laboratory, Shenzhen 518000, China
School of Computer Science and Technology, Harbin Institute of Technology, Harbin 150000, China
School of Computer Science and Engineering, VIT University, Vellore 632014, India
Funding
the Key Research and Development Program for Guangdong Province · the Peng Cheng Laboratory Project of Guangdong Province
References (28)
Show source-provided references
1. McGrath, D.K., and Gupta, M. (2008, January 15). Behind Phishing: An Examination of Phisher Modi Operandi. Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, San Francisco, CA, USA.
2. Ma, J., Saul, L.K., Savage, S., and Voelker, G.M. (July, January 28). Beyond Blacklists: Learning to Detect Malicious Web Sites from Suspicious URLs. Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Paris, France.
3. Felegyhazi, M., Kreibich, C., and Paxson, V. (2010, January 17). On the Potential of Proactive Domain Blacklisting. Proceedings of the 3rd USENIX Conference on Large-scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More, San Jose, CA, USA.
4. Bilge, L., Kirda, E., Kruegel, C., and Balduzzi, M. (2011, January 6). EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis. Proceedings of the 18th Network and Distributed System Security Symposium, San Diego, CA, USA.
5. Canali, D., Cova, M., Vigna, G., and Kruegel, C. (April, January 28). Prophiler: A Fast Filter for the Large-scale Detection of Malicious Web Pages. Proceedings of the 20th International Conference on World Wide Web, Hyderabad, India.
6. Zhang, J., Saha, S., Gu, G., Lee, S., and Mellia, M. (July, January 29). Systematic Mining of Associated Server Herds for Malware Campaign Discovery. Proceedings of the 2015 IEEE 35th International Conference on Distributed Computing Systems, Columbus, OH, USA.10.1109/ICDCS.2015.70 ↗
7. GReAT (2019, June 27). Winnti. More than Just a Game. Available online: https://securelist.com/analysis/internal-threats-reports/37029/winnti-more-than-just-a-game/.
8. Detecting Algorithmically Generated Domain-Flux Attacks With DNS Traffic Analysis10.1109/TNET.2012.2184552 ↗
9. Antonakakis, M., Perdisci, R., Nadji, Y., Vasiloglou, N., Abu-Nimeh, S., Lee, W., and Dagon, D. (2012, January 8–10). From Throw-away Traffic to Bots: Detecting the Rise of DGA-based Malware. Proceedings of the 21st USENIX Conference on Security Symposium, Bellevue, WA, USA.
10. Antonakakis, M., Perdisci, R., Dagon, D., Lee, W., and Feamster, N. (2010, January 11–13). Building a Dynamic Reputation System for DNS. Proceedings of the 19th USENIX Conference on Security, Washington, DC, USA.
11. Yadav, S., Reddy, A.K.K., Reddy, A.N., and Ranjan, S. (2010, January 1–3). Detecting Algorithmically Generated Malicious Domain Names. Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement, Melbourne, Australia.10.1145/1879141.1879148 ↗
12. Krishnan, S., Taylor, T., Monrose, F., and McHugh, J. (2013, January 24–27). Crossing the threshold: Detecting network malfeasance via sequential hypothesis testing. Proceedings of the 2013 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Budapest, Hungary.10.1109/DSN.2013.6575364 ↗
13. Jain, A.K., and Dubes, R.C. (1988). Algorithms for Clustering Data, Prentice-Hall, Inc.
14. Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains10.1145/2584679 ↗
15. Dietrich, S. (2014). Phoenix: DGA-Based Botnet Tracking and Intelligence. Detection of Intrusions and Malware, and Vulnerability Assessment, Springer International Publishing.
16. Woodbridge, J., Anderson, H.S., Ahuja, A., and Grant, D. (2016). Predicting Domain Generation Algorithms with Long Short-Term Memory Networks. arXiv.
17. Yu, B., Gray, D.L., Pan, J., Cock, M.D., and Nascimento, A.C.A. (2017, January 18–21). Inline DGA Detection with Deep Networks. Proceedings of the 2017 IEEE International Conference on Data Mining Workshops (ICDMW), New Orleans, LA, USA.10.1109/ICDMW.2017.96 ↗
18. Learning representations by back-propagating errors10.1038/323533a0 ↗
19. Long Short-Term Memory10.1162/neco.1997.9.8.1735 ↗
20. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., and Polosukhin, I. (2017). Attention Is All You Need. arXiv.
21. Graves, A., Wayne, G., and Danihelka, I. (2014). Neural Turing Machines. arXiv.
22. Luong, M.T., Pham, H., and Manning, C.D. (2015). Effective approaches to attention-based neural machine translation. arXiv Preprint.10.18653/v1/D15-1166 ↗
23. Cheng, J., Li, D., and Lapata, M. (2016). Long Short-Term Memory-Networks for Machine Reading. arXiv.10.18653/v1/D16-1053 ↗
24. Bambenek, J. (2019, September 10). OSINT Feeds from Bambenek Consulting. Available online: http://osint.bambenekconsulting.com/feeds/.
25. Alex (2019, September 10). Keyword Research, Competitive Analysis, & Website Ranking | Alexa. Available online: https://www.alexa.com/.
26. Cohen, R. (2019, September 03). Banking Trojans: A Reference Guide to the Malware Family Tree. Available online: https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree.
27. Kessem, L. (2019, September 03). The Necurs Botnet: A Pandora’s Box of Malicious Spam. Available online: https://securityintelligence.com/the-necurs-botnet-a-pandoras-box-of-malicious-spam/.
28. Spring, T. (2019, September 03). Locky Ransomware Roars Back to Life Via Necurs Botnet. Available online: https://threatpost.com/locky-ransomware-roars-back-to-life-via-necurs-botnet/125156/.