A Machine Learning-Based Botnet Malicious Domain Detection Technique for New Business

In the new network business,the danger of botnets should not be underestimated.Botnets often generatemalicious domain names through DGAs to enable communication with command and control servers(C&C)and then receive commands from the botmaster,carrying out further attack activities.Therefore,a system based onmachine learning to dichotomizeDNSdomain access is designed,which can instantly detectDGAdomain names and thus quickly dispose of infected computers to avoid spreading the virus and further damage.In the comparison,the bidirectional LSTM model slightly outperformed the unidirectional LSTM network and achieved 99%accuracy in the open dataset classification task.

A DGA domain names detection modeling method based on integrating an attention mechanism and deep neural network

Command and control(C2)servers are used by attackers to operate communications.To perform attacks,attackers usually employee the Domain Generation Algorithm(DGA),with which to confirm rendezvous points to their C2 servers by generating various network locations.The detection of DGA domain names is one of the important technologies for command and control communication detection.Considering the randomness of the DGA domain names,recent research in DGA detection applyed machine learning methods based on features extracting and deep learning architectures to classify domain names.However,these methods are insufficient to handle wordlist-based DGA threats,which generate domain names by randomly concatenating dictionary words according to a special set of rules.In this paper,we proposed a a deep learning framework ATT-CNN-BiLSTMfor identifying and detecting DGA domains to alleviate the threat.Firstly,the Convolutional Neural Network(CNN)and bidirectional Long Short-Term Memory(BiLSTM)neural network layer was used to extract the features of the domain sequences information;secondly,the attention layer was used to allocate the corresponding weight of the extracted deep information from the domain names.Finally,the different weights of features in domain names were put into the output layer to complete the tasks of detection and classification.Our extensive experimental results demonstrate the effectiveness of the proposed model,both on regular DGA domains and DGA that hard to detect such as wordlist-based and part-wordlist-based ones.To be precise,we got a F1 score of 98.79%for the detection and macro average precision and recall of 83%for the classification task of DGA domain names.

MCL4DGA:基于多视角对比学习的DGA域名检测方法

在网络安全领域,由域名生成算法(domain generation algorithm,DGA)产生的虚假域名被称为DGA域名.与正常域名类似的是,DGA域名通常是字母或数字的随机组合,这使得DGA域名具有较强的伪装性.网络黑客利用DGA域名的伪装性实施网络攻击,以达到绕过安全检测的目的.如何有效地对DGA域名进行检测,进而维护信息系统安全,成为当前的研究热点.传统的统计机器学习检测方法需要人工构建域名字符特征集合.然而,人工或者半自动化方式构建的域名特征存在质量参差不齐的情况,进而影响检测的准确性.鉴于深度神经网络强大的特征自动化抽取和表示能力,提出一种基于多视角对比学习的DGA域名检测方法(MCL4DGA).与现有方法不同的是,所提方法结合了注意力神经网络、卷积神经网络和循环神经网络,能够有效地捕获域名字符序列中的全局、局部和双向多视角特征依赖关系.除此之外,通过多视角表示向量之间的对比学习而产生的自监督信号,能够增强模型的学习能力,进而提高检测的准确性.通过在真实数据集上与当前DGA域名检测方法实验对比验证了所提方法的有效性.

A DGA domain names detection modeling method based on integrating an attention mechanism and deep neural network

Command and control(C2)servers are used by attackers to operate communications.To perform attacks,attackers usually employee the Domain Generation Algorithm(DGA),with which to confirm rendezvous points to their C2 servers by generating various network locations.The detection of DGA domain names is one of the important technologies for command and control communication detection.Considering the randomness of the DGA domain names,recent research in DGA detection applyed machine learning methods based on features extracting and deep learning architectures to classify domain names.However,these methods are insufficient to handle wordlist-based DGA threats,which generate domain names by randomly concatenating dictionary words according to a special set of rules.In this paper,we proposed a a deep learning framework ATT-CNN-BiLSTMfor identifying and detecting DGA domains to alleviate the threat.Firstly,the Convolutional Neural Network(CNN)and bidirectional Long Short-Term Memory(BiLSTM)neural network layer was used to extract the features of the domain sequences information;secondly,the attention layer was used to allocate the corresponding weight of the extracted deep information from the domain names.Finally,the different weights of features in domain names were put into the output layer to complete the tasks of detection and classification.Our extensive experimental results demonstrate the effectiveness of the proposed model,both on regular DGA domains and DGA that hard to detect such as wordlist-based and part-wordlist-based ones.To be precise,we got a F1 score of 98.79% for the detection and macro average precision and recall of 83% for the classification task of DGA domain names.

DGA-Based Botnet Detection Toward Imbalanced Multiclass Learning

Botnets based on the Domain Generation Algorithm(DGA) mechanism pose great challenges to the main current detection methods because of their strong concealment and robustness. However, the complexity of the DGA family and the imbalance of samples continue to impede research on DGA detection. In the existing work, the sample size of each DGA family is regarded as the most important determinant of the resampling proportion;thus,differences in the characteristics of various samples are ignored, and the optimal resampling effect is not achieved.In this paper, a Long Short-Term Memory-based Property and Quantity Dependent Optimization(LSTM.PQDO)method is proposed. This method takes advantage of LSTM to automatically mine the comprehensive features of DGA domain names. It iterates the resampling proportion with the optimal solution based on a comprehensive consideration of the original number and characteristics of the samples to heuristically search for a better solution around the initial solution in the right direction;thus, dynamic optimization of the resampling proportion is realized.The experimental results show that the LSTM.PQDO method can achieve better performance compared with existing models to overcome the difficulties of unbalanced datasets;moreover, it can function as a reference for sample resampling tasks in similar scenarios.