On Detecting and Classifying DGA Botnets and their Families

Abstract

Botnets are a frequent threat to information systems on the Internet, capable of launching denial-of-service attacks, spreading spam and malware on a large scale. Detecting and preventing botnets is very important in cybersecurity. Previous studies have suggested anomaly-based, signature-based, or HoneyNet-based botnet detection solutions. This paper presents new solutions for detecting and classifying families of Domain Generation Algorithm (DGA) botnets. Our solution can be applied in practice to disable botnets even if they have infected the computer. Our works help solve two problems, including binary classification and multiclass classification, specifically: (1) Determining whether a domain name is malicious or benign; (2) For malicious domains, identify their DGA botnet family. We proposed two deep learning models called LA_Bin07 and LA_Mul07 by combining the LSTM network and Attention layer. Our evaluation used the UMUDGA dataset recently published in 2020, with 50 DGA botnet families. The experimental results show that the LA_Bin07 and LA_Mul07 models solve the DGA botnets problem for binary and multiclass classification problems with very high accuracy.