Inline Detection of DGA Domains Using Side Information

Malware applications typically use a command and control (C&C) server to manage bots to perform malicious activities. Domain Generation Algorithms (DGAs) are popular methods for generating pseudo-random domain names that can be used to establish a communication between an infected bot and the C&...

Full description

Saved in:
Bibliographic Details
Published in:IEEE access 2020, Vol.8, p.141910-141922
Main Authors: Sivaguru, Raaghavi, Peck, Jonathan, Olumofin, Femi, Nascimento, Anderson, De Cock, Martine
Format: Article
Language:English
Subjects:
Adversarial machine learning
Algorithms
Classifiers
Command and control
DGA detection
Domain names
Feature extraction
Machine learning
Machine learning algorithms
Malware
Performance prediction
Pseudorandom
Robustness
Servers
side information
State-of-the-art reviews
Traffic information
URLs
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Malware applications typically use a command and control (C&C) server to manage bots to perform malicious activities. Domain Generation Algorithms (DGAs) are popular methods for generating pseudo-random domain names that can be used to establish a communication between an infected bot and the C&C server. In recent years, machine learning based systems have been widely used to detect DGAs. There are several well known state-of-the-art classifiers in the literature that can detect DGA domain names in real-time applications with high predictive performance. However, these DGA classifiers are highly vulnerable to adversarial attacks in which adversaries purposely craft domain names to evade DGA detection classifiers. In our work, we focus on hardening DGA classifiers against adversarial attacks. To this end, we train and evaluate state-of-the-art deep learning and random forest (RF) classifiers for DGA detection using side information that is harder for adversaries to manipulate than the domain name itself. Additionally, the side information features are selected such that they are easily obtainable in practice to perform inline DGA detection. The performance and robustness of these models is assessed by exposing them to one day of real-traffic data as well as domains generated by adversarial attack algorithms. We found that the DGA classifiers that rely on both the domain name and side information have high performance and are more robust against adversaries.
ISSN:2169-3536
2169-3536
DOI:10.1109/ACCESS.2020.3013494