A Detection Scheme for DGA Domain Names Based on SVM

Abstract

Most of network security configurations allow the DNS data to pass through. Therefore, the crackers often embed malware commands in DNS data to avoid the security detection by the Internet facilities. Especially, some malwares, such as the botnet, generate a large number of spare domain names using a Domain Generation Algorithm (DGA) and choose some of them as the masks of malware's commands. How to filter out the DGA domain names from the normal domain names becomes a hot topic in literature. There are many papers trying to solve this problem. However, the comprehensive analysis of the character features of the domain name is absent. In this paper, we studied the characters' features of DGA domain names and extracted five attributes for the Support Vector Machine (SVM) model. Model training and cross-validation showed that the detecting accuracy, the precision, and the recall rate were greater than 91%, 88%, and 87%, respectively. Experiments also illustrated that compared with the decision-tree method, the detecting algorithm based on SVM could obtain higher accuracy, precision and recall rate.

Inline Detection of DGA Domains Using Side Information

“…Content may change prior to final publication. [14], [20], [27], [29] sld_len Second level domain length [13], [14], [20] tld_len Top level domain length [13], [14], [20] uni_domain Domain Unique Characters length [13], [14], [20] uni_sld SLD Unique Characters length [13], [14], [20] uni_tld TLD Unique Characters length [13], [14], [20] flag_dga Has malicious TLD [13], [14], [20], [27] tld_hash TLD Hash [6], [13], [14], [20] flag_dig Starts with Digit [6], [13], [14], [20] sym Symbol ratio [6], [13], [14], [20] hex Hex ratio [6], [13], [14], [20] dig Digit Ratio [4], [11]- [14], [17], [20], [29] vow Vowel Ratio [4], [6]...…”

“…The RData in a DNS response encompasses a list of resolved IP addresses, the time-to-live value of the query and the type of resource record. [8], [5], [4], [15], [26] [27], [6], [14], [13], [28] Side information features [29], [30], [16], [31], [32] our work Domain name string + [18], [33], [3], [34], [35] our work side information features [17], [10], [11], [12] TABLE I Overview of existing work on DGA detection ture would be "multi-valued". Alternatively, if the location could not be identified, then this feature takes the value "unknown".…”

“…The value of the feature domain len for the domain name "google.com" is 10. [20], [14], [6], [13], [4], [26], [28], [11], [12] sld len Second level domain length [20], [14], [13] tld len Top level domain length [20], [14], [13] uni domain Domain Unique Characters length [20], [14], [13] uni sld SLD Unique Characters length [20], [14], [13] uni tld TLD Unique Characters length [20], [14], [13] flag dga Has malicious TLD [20], [14], [13], [26] tld hash TLD Hash [20], [14], [13], [6] flag dig…”

“…[20], [14], [13], [6] sym Symbol ratio [20], [14], [13], [6] hex Hex ratio [20], [14], [13], [6] dig Digit Ratio [20], [14], [13], [4], [28], [17], [11], [12] vow Vowel Ratio [20], [14], [13], [6], [4], [28] con Consonant Ratio [20], [14], [13] rep char ratio Ratio of Repeated Characters [20], [14], [4] cons con ratio Ratio of Consecutive Consonants [20], [14], [4], [28] cons dig ratio Ratio of Consecutive Digits [20], [14], [4] tokens sld Number of tokens in SLD [20], [14], [13], [26] digits sld Number of digits in SLD [20], [14], [13], [26] ent Entropy of characters in SLD [20], [14], …”

Domain-Embeddings Based DGA Detection with Incremental Training Method

“…In order to detect DGA domains, Yadav et al [4] proposed a technique based on the significant difference between traditional DGA domains and human generated domains in terms of the distribution of alphanumeric characters. In addition, Antonakakis et al [1], Schüppen et al [5] and Wang et al [6] proposed machine-learning based DGA detectors using human-engineered lexical features of DGA domain names, while Tong et al [7], Lison et al [8] and Tran et al [9] came up with some methods using deep learning algorithms such as CNN, LSTM, and BiLSTM. However, attackers have designed a more resilient class of mAGDs produced by randomly selecting and concatenating words from a dictionary in order to imitate legitimate domain names created by a human.…”