Making use of NXt to nothing

Abstract

Numerous machine learning classifiers have been proposed for binary classification of domain names as either benign or malicious, and even for multiclass classification to identify the domain generation algorithm (DGA) that generated a specific domain name. Both classification tasks have to deal with the class imbalance problem of strongly varying amounts of training samples per DGA. Currently, it is unclear whether the inclusion of DGAs for which only a few samples are known to the training sets is beneficial or harmful to the overall performance of the classifiers. In this paper, we perform a comprehensive analysis of various contextless DGA classifiers, which reveals the high value of a few training samples per class for both classification tasks. We demonstrate that the classifiers are able to detect various DGAs with high probability by including the underrepresented classes which were previously hardly recognizable. Simultaneously, we show that the classifiers' detection capabilities of well represented classes do not decrease. CCS CONCEPTS • Security and privacy → Intrusion detection systems; Malware and its mitigation; • Computing methodologies → Machine learning.

Analyzing the real-world applicability of DGA classifiers

“…We use the same evaluation metrics as in the original papers: accuracy 1 We intentionally include underrepresented classes because the inclusion of a few training samples per class allows a classifier to detect various underrepresented DGAs with high probability that would otherwise be missed. At the same time, this does not affect a classifier's ability to recognize well-represented classes [15]. We present the averaged results of the four-fold cross validation in Table 1.…”

“…It is important to understand the applied domain name preprocessing as this step can introduce significant classification biases. The works (e.g., [13][14][15]34]) that operate on single NXDs for classification make the data used unique and filter all benign samples against OSINT feeds to remove potentially contained malicious domains before training and testing a classifier. Other than that, they do not apply any filtering to the benign-labeled data used, since it is captured from real-world networks.…”