Abstract
Domain generation algorithms (DGAs) are widely used in modern botnets to generate a large number of domain names through which bots can communicate with their command and control (C & C) servers. In recent years, many machine learning based approaches have been proposed to automatically detect algorithmically generated domains in real time and have achieved success in traditional DGAs. Nevertheless, they are somewhat unavailable for adversarial domains. In this paper, we develop a more threatening DGA called ShadowDGA that utilizes generative adversarial networks (GANs) to simulate the distribution of benign domains without any knowledge about the DGA detector to evade detection. Experimental results demonstrate that the domains generated by ShadowDGA are the most difficult to detect compared to existing DGA families. We also present an effective defense method for adversarial domains without retraining. These findings indicate that detectors that rely solely on features extracted from the domain name are vulnerable, while a robust DGA detector should contain additional contextual information.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.