Analyzing the real-world applicability of DGA classifiers

Abstract

Separating benign domains from domains generated by DGAs with the help of a binary classifier is a well-studied problem for which promising performance results have been published. The corresponding multiclass task of determining the exact DGA that generated a domain enabling targeted remediation measures is less well studied. Selecting the most promising classifier for these tasks in practice raises a number of questions that have not been addressed in prior work so far. These include the questions on which traffic to train in which network and when, just as well as how to assess robustness against adversarial attacks. Moreover, it is unclear which features lead a classifier to a decision and whether the classifiers are real-time capable. In this paper, we address these issues and thus contribute to bringing DGA detection classifiers closer to practical use. In this context, we propose one novel classifier based on residual neural networks for each of the two tasks and extensively evaluate them as well as previously proposed classifiers in a unified setting. We not only evaluate their classification performance but also compare them with respect to explainability, robustness, and training and classification speed. Finally, we show that our newly proposed binary classifier generalizes well to other networks, is time-robust, and able to identify previously unknown DGAs. CCS CONCEPTS• Security and privacy → Intrusion detection systems; Malware and its mitigation; • Computing methodologies → Machine learning.

Finding Phish in a Haystack: A Pipeline for Phishing Classification on Certificate Transparency Logs

“…In detail, the RNN-based approach uses one unidirectional long short-term memory (LSTM) layer for the domain name and one bidirectional LSTM layer to process the features. Before a domain name is fed into the model, we convert every included character to a unique integer and pad the result with zeros from the left side to the maximal domain length of 253 characters [26] as proposed in [13]. This ensures that the model is able to process domain names at any length while using batch learning.…”

Sharing FANCI Features: A Privacy Analysis of Feature Extraction for DGA Detection

“…A variety of different DGA detection techniques have been proposed in the past, which can broadly be divided into context-less [2]- [6] and context-aware approaches [7]- [12]. Context-less approaches only use information that can be extracted from a single domain name to determine whether a domain name is benign or malicious while context-aware approaches use additional contextual information to improve classification performance.…”

“…Context-less approaches only use information that can be extracted from a single domain name to determine whether a domain name is benign or malicious while context-aware approaches use additional contextual information to improve classification performance. Previous studies suggest that context-less approaches achieve state-of-the-art detection performance while being less resource intensive and less privacy invasive than context-aware approaches [2]- [4] [6] .…”

“…The context-less approaches can further be divided into feature-based classifiers such as random forests or support vector machines (e.g., [2]), and feature-less classifiers such as recurrent, convolutional, or residual neural networks [3][4] [6]. The former group uses domain knowledge to extract handcrafted features from a single domain name prior to classification.…”

“…(5) We assume feature sets are shared in the clear, hence no interaction with the target is required. (6) We allow the adversary to be in possession of an arbitrary large data set S ′′ ⊂ S of benign NXDs that does not intersect with the target's data, i.e., S ′′ ∩ S ′ = ∅. (7) We do not restrict the adversary's computational power that he may apply to his own data.…”