A Deep learning framework for domain generation algorithm based malware detection

Abstract

Command and control server, also known as C2 or C&C related cyberat-tacks have sharply grown in recent years. Attackers typically use a domain generating algorithm (DGA) to generate domain names in a random fashion for their C&C servers automatically. As a result, a thorough investigation into the identification of DGA domains has been conducted. On the other side, a lot of anti-malware programmes rely on network whitelisting, hashing, or static string verification. These strategies are fundamental for usage with those risky malware attacks, which can conceal their existence and employ various techniques to evade detection. A two-level model makes up the suggested deep learning framework. First, features from the domain names are generated using a feature generator. Next, DGA domains are distinguished from other domain types, and last, the clustering phase is utilised to pinpoint the type of those DGA domains. This paper demonstrates how the suggested system can efficiently extract the attributes from the domain names, as well as group, categorise, and detect harmful domains with more precision. When compared to other models, the proposed model performs better.