A Survey Report on Identifying Different Machine Learning Algorithms in Detecting Domain Generation Algorithms within Enterprise Network

Abstract

Anomaly detection is done to identify the abnormal patterns that deviate from the majority of data. It is also known as outlier detection. Detection of Domain Generation Algorithms is also a type of anomaly detection. In this paper, we talked about Domain Generation Algorithms (DGA). Malware uses Domain Generation Algorithms to communicate with Command and Control (CnC) servers managed by hackers. As DGAs are generated randomly, it is hard to detect them in real-time using signature-based software. DGA activates for a short time. So threat intelligent software sometimes fails to recognize if the URL is DGA or genuine. In this paper, research is done in machine learning algorithms such as random forest and deep learning techniques such as LSTM and neural networks which will help to detect patterns of DGA. Using the DGA technique malware starts communicating with this server. As this is a type of advanced persistent threat, this results in intellectual and financial losses of enterprises. The traditional techniques consist of blacklisting malware and URLs. Automatic detection of this DGAs is a crucial task. This imposes an overheard as DGA gets generated in large volumes.