Malicious Domain Name Detection Research Articles

Deep learning DGA malicious domain name detection based on multi-stage feature fusion

Deep learning DGA malicious domain name detection based on multi-stage feature fusion

N-Trans: Parallel Detection Algorithm for DGA Domain Names

Domain name generation algorithms are widely used in malware, such as botnet binaries, to generate large sequences of domain names of which some are registered by cybercriminals. Accurate detection of malicious domains can effectively defend against cyber attacks. The detection of such malicious domain names by the use of traditional machine learning algorithms has been explored by many researchers, but still is not perfect. To further improve on this, we propose a novel parallel detection model named N-Trans that is based on the N-gram algorithm with the Transformer model. First, we add flag bits to the first and last positions of the domain name for the parallel combination of the N-gram algorithm and Transformer framework to detect a domain name. The model can effectively extract the letter combination features and capture the position features of letters in the domain name. It can capture features such as the first and last letters in the domain name and the position relationship between letters. In addition, it can accurately distinguish between legitimate and malicious domain names. In the experiment, the dataset is the legal domain name of Alexa and the malicious domain name collected by the 360 Security Lab. The experimental results show that the parallel detection model based on N-gram and Transformer achieves 96.97% accuracy for DGA malicious domain name detection. It can effectively and accurately identify malicious domain names and outperforms the mainstream malicious domain name detection algorithms.

A Malicious Domain Detection Model Based on Improved Deep Learning.

With the rapid development of the Internet, malicious domain names pose more and more serious threats to many fields, such as network security and social security, and there have been many research results on malicious domain detection. This article proposes a malicious domain name detection model based on improved deep learning, which can combine the advantages of three different network models, convolutional neural network (CNN), temporal convolutional network (TCN), and long short-term memory network (LSTM) in malicious domain name detection, to obtain a better detection effect than that of the original single or two models. Experiments show that the effect of the improved deep learning model proposed in this article is better than that of the combined model of CNN and LSTM or the combined model of CNN and TCN, and the accuracy and regression rates reached 99.76% and 98.81%, respectively.

Online malicious domain name detection with partial labels for large-scale dependable systems

Detecting malicious non-existent domain names (NXDomains) in a real-time manner is vitally important to the security of large-scale dependable systems. Existing detection methods are trained based on the assumption that the NXDomains, which cannot be recognized by the domain generation algorithm (DGA) archive, are benign. However, new types of malicious NXDomains are continuously generated, and the DGA archive cannot cover all of them, making the NXDomains partially labeled. Additionally, extracting all the features for distinguishing malicious and benign NXDomains is computationally inefficient and inappropriate for online detection in large-scale dependable systems. This work proposes a framework, PUFS, to train an accurate malicious NXDomain detection model according to partial labels and conduct efficient online detection for large-scale dependable systems. PUFS adopts a novel, simple, yet effective three-step strategy to combine PU learning and feature selection. We conduct extensive experiments using real-world data collected from a top-tier global online bank. PUFS achieves 99.19% of F1-Score, and improves the feature extraction efficiency by 1153%, making it suitable for online detection scenarios.

Fast3DS: A real-time full-convolutional malicious domain name detection system

Detecting malicious domain names generated by domain generation algorithms is critical for defending the network against sophisticated attacks. In the past decade, deep-learning-based detection schemes have proven to be the most effective. However, each of these schemes requires sufficient computation time, which makes it difficult for real-time online detection. In this paper, we propose a real-time malicious domain name detection system which is called fast3DS. The proposed system contains a lightweight full-convolutional detection model, as well as a detection pipeline that contains multiple efficient schemes for high-speed data acquisition, filtering, and inference. The proposed detection model uses a parallel depthwise convolutional architecture to replace the standard convolution layer, and a lightweight global average pooling connection architecture is proposed to replace the fully connected layer, which can effectively reduce the parameters and computation time. To compensate for the decrease in accuracy due to model lightweighting, a lightweight attention mechanism is proposed to improve the accuracy of model detection. The proposed detection pipeline employs some industry-leading network traffic processing architecture and deep learning inference acceleration architecture, which can fully utilize the CPU for processing and computing. The experimental results denote that the proposed detection scheme can achieve accuracy close to the state-of-the-art with significantly fewer parameters, and the system can substantially improve the processing capability compared to the conventional detection system.

Malicious Domain Name Detection Based on Doc2vec and Hybrid Network

In traditional malicious domain name detection algorithms, machine learning detection methods take a long time to extract features and the extraction methods are more complex; deep learning detection methods are easy to lose the semantic features of the entire domain name, and the detection results of a single neural network for different sample data sets are unstable . In response to the above problems, a malicious domain name detection method based on Doc2vec and hybrid network was proposed, and a new DLR (Doc2vec-LSTM-RNN) detection model was constructed. The word vector is constructed using the Doc2vec algorithm optimized on the basis of the Word2vec algorithm, which retains the semantic information of the domain name as a whole; and mixes the bidirectional LSTM network and the bidirectional RNN network in series to carry out deep-level feature extraction and enhance the robustness of the detection model; finally the Softmax function is used to output the classification result. Experimental data shows that this method has excellent performance in malicious domain name detection. Compared with traditional machine learning and deep learning detection methods, it has higher detection accuracy.

Detection of Algorithmically Generated Domain Names Using the Recurrent Convolutional Neural Network with Spatial Pyramid Pooling.

Domain generation algorithms (DGAs) use specific parameters as random seeds to generate a large number of random domain names to prevent malicious domain name detection. This greatly increases the difficulty of detecting and defending against botnets and malware. Traditional models for detecting algorithmically generated domain names generally rely on manually extracting statistical characteristics from the domain names or network traffic and then employing classifiers to distinguish the algorithmically generated domain names. These models always require labor intensive manual feature engineering. In contrast, most state-of-the-art models based on deep neural networks are sensitive to imbalance in the sample distribution and cannot fully exploit the discriminative class features in domain names or network traffic, leading to decreased detection accuracy. To address these issues, we employ the borderline synthetic minority over-sampling algorithm (SMOTE) to improve sample balance. We also propose a recurrent convolutional neural network with spatial pyramid pooling (RCNN-SPP) to extract discriminative and distinctive class features. The recurrent convolutional neural network combines a convolutional neural network (CNN) and a bi-directional long short-term memory network (Bi-LSTM) to extract both the semantic and contextual information from domain names. We then employ the spatial pyramid pooling strategy to refine the contextual representation by capturing multi-scale contextual information from domain names. The experimental results from different domain name datasets demonstrate that our model can achieve 92.36% accuracy, an 89.55% recall rate, a 90.46% F1-score, and 95.39% AUC in identifying DGA and legitimate domain names, and it can achieve 92.45% accuracy rate, a 90.12% recall rate, a 90.86% F1-score, and 96.59% AUC in multi-classification problems. It achieves significant improvement over existing models in terms of accuracy and robustness.

Detection of Malicious Domain Name Based on DNS Data Analysis

This paper describes the research background of malicious domain name detection based on DNS data analysis, obtains DNS data through active domain name data or passive domain name data, then obtains DNS data through knowledge-based methods, detection methods based on machine learning and hybrid methods, and finally puts forward research suggestions.

MaldomDetector: A system for detecting algorithmically generated domain names with machine learning

One of the leading problems in cyber security at present is the unceasing emergence of sophisticated attacks, such as botnets and ransomware, that rely heavily on Command and Control (C&C) channels to conduct their malicious activities remotely. To avoid channel detection, attackers constantly try to create different covert communication techniques. One such technique is Domain Generation Algorithm (DGA), which allows malware to generate numerous domain names until it finds its corresponding C&C server. It is highly resilient to detection systems and reverse engineering, while allowing the C&C server to have several redundant domain names. This paper presents a malicious domain name detection system, MaldomDetector, which is based on machine learning. It is capable of detecting DGA-based communications and circumventing the attack before it makes any successful connection with the C&C server, using only domain name's characters. MaldomDetector uses a set of easy-to-compute and language-independent features in addition to a deterministic algorithm to detect malicious domains. The experimental results demonstrate that MaldomDetector can operate efficiently as a first alarm to detect DGA-based domains of malware families while maintaining high detection accuracy.

LSTM Network Based Malicious Domain Name Detection

Detecting malicious domain names attract lot of research in recent years. Researchers tried various text based, network traffic based and combination of these methods to detect malicious names. In this paper, we analyze the possibility of detection malicious names using deep neural network based models. Bidirectional LSTM network has been developed and trained on the dataset. Two tasks were experimented. First task was to identify malicious domain name and second task was to identify the class of domain name. Proposed method is able to perform well on task 1 producing 98.9% accuracy whereas on task 2 it is able to achieve accuracy of 69.7% only.

Detection of malicious domain names based on an improved hidden Markov model

The ability to detect malicious domain names is critical for protection against internet security, data theft, and other dangers. Current methods for recognising malicious domain names have demonstrated poor detection accuracy in dealing with massive data. This paper proposes a novel malicious domain name detection method based on an improved Hidden Markov Model (HMM). Firstly, by analysing various characteristics of good and evil domain names in DNS communication, we can use Spark fast extraction to distinguish their attributes; then, we can quickly classify unknown domain names accurately by using Baum-Welch algorithm and Viterbi algorithm in Hidden Markov Model (BVHMM) to achieve the effective detection of malicious domain names; finally, to test our approach, we conducted a series of experiments, and the experimental results demonstrate that our model achieves good accuracy and recall rate as compared with other detection models.

Detection of malicious domain names based on an improved hidden Markov model

The ability to detect malicious domain names is critical for protection against internet security, data theft, and other dangers. Current methods for recognising malicious domain names have demonstrated poor detection accuracy in dealing with massive data. This paper proposes a novel malicious domain name detection method based on an improved Hidden Markov Model (HMM). Firstly, by analysing various characteristics of good and evil domain names in DNS communication, we can use Spark fast extraction to distinguish their attributes; then, we can quickly classify unknown domain names accurately by using Baum-Welch algorithm and Viterbi algorithm in Hidden Markov Model (BVHMM) to achieve the effective detection of malicious domain names; finally, to test our approach, we conducted a series of experiments, and the experimental results demonstrate that our model achieves good accuracy and recall rate as compared with other detection models.

The Design and Implementation of a Covering MDN-Complete-Life-Cycle Malicious Domain Detection Framework

Malicious domain name (MDN) detection has seen greatly progress in recent years. In this paper, one covering MDN-Complete-Life-Cycle malicious domain name detection framework is proposed. The framework includes three detection models: DGAD-M (Domain Generation Algorithm Detection Model), DIPD-M (Domain IP Detection Model) and DHTD-M (Domain Host Detection Model), corresponding to the process of the malicious domain generation, malicious domain name resolution and the host requesting a domain. DGAD-M bases on the fact that the domains generated by DGA are always short of natural language features, it adopts Convolutional Neural Network. DIPD-M bases on the fact that the IP addresses of the malicious domains are more disperse and updated frequently. DHTD-M bases on the fact that the domains requested by infected hosts are frequently tend to be malicious. The results of DGAD-M and DIPD-M will be used by DHTD-M. The framework got the accuracy rate of 83.652% with the real network flow and found out 115 suspicious malicious domains.