Detecting malicious domain names from domain generation algorithms using bi-directional LSTM network

Abstract

DNS (Domain Name System /DNS) is one of the most important infrastructures of Internet. People can easily access the rich network resources worldwide using the DNS technology. However, the Domain Generation Algorithm (DGA) is also accompanied by the DNS technology, which is used to generate malicious domain names. To detect DGA malicious domains, the previous studies often used unreal small DNS domain name datasets to train the detection models that always overlooked real user data traffic. These models generally did not have good generalization performance. In this paper, we propose a new DGA malicious domain name detection model based on Bi-directional LSTM network. We also propose a new evaluation metric to evaluate the real unlabeled DNS traffic data. Compared with LSTM model, the detection effect of our proposed model is improved effectively. The experimental results show that the precision of the model and the value of AUC reach 98.4% and 0.9079, respectively.