Dom2Vec - Detecting DGA Domains Through Word Embeddings and AI/ML-Driven Lexicographic Analysis

• Main Authors: Aravena, L. Torrealba, Casas, P., Bustos-Jimenez, J., Capdehourat, G., Findrik, M.
• Format: Conference Proceeding
• Language: English
• Subjects: Botnet; DGA Detection; DNS; Domain Name System; Feature extraction; Frequency-domain analysis; Lexicographic Analysis; Machine Learning; Malware; n-grams; TF-IDF; Word2Vec
• ISSN: 2165-963X
• DOI: 10.23919/CNSM59352.2023.10327913

The timely identification of DNS queries to Domain Generation Algorithm (DGA) domains plays a critical role in mitigating malware propagation and its potential impact, especially in thwarting coordinated botnet activity. We introduce Dom2Vec, an innovative approach for swiftly detecting DGA-generated domains by leveraging lexicographic features exclusively derived from the observed domain names in DNS queries. Dom2Vec leverages word embeddings to map tokens extracted from domain names into highly expressive representations. These representations are then combined with a reputation-based scoring system for domain names, which utilizes the co-occurrence frequency of n-grams in relation to a list of whitelisted domains. The fusion of domain embeddings, reputation scores, and other meaningful lexicographic features derived from domain names provides robust domain name representations for AI/ML-driven detection of DGAs. Through experimental evaluation on a dataset comprising 25 distinct families of DGA domains, we demonstrate that Dom2Vec significantly outperforms current state-of-the-art approaches for DGA detection and analysis, improving our previous detection system based on reputation scores by at least 30%, for a false-alarm rate below 1%.