Machine Learning-Based Algorithmically Generated Domain Detection

Published

May 1, 2022

Author(s)

Zheng Wang, Yang Guo, Douglas Montgomery

Abstract

Malware like botnets typically uses domain generation algorithms (DGAs) to dynamically produce a large number of random algorithmically generated domains (AGDs) and use a few of them to communicate with the command and control servers. AGD detection provides a lightweight yet effective solution to the threats imposed by DGA-based malware. For example, the linguistic distance between domain names was found as the promising metric to identify AGDs from benign domains. However, the distance metrics are not informatively enough used by the conventional approach. We propose to use machine learning algorithms on the distance metrics. Feature engineering techniques are proposed to boost detection performance. The results show that our proposal can outperform the existing algorithms, with a detection accuracy of over 99% for the tested DGAs. The permutation feature importance analysis is presented for explainability. The deployment locations of the AGD detectors are discussed.

Citation

Computers & Electrical Engineering

Volume

100

Pub Type

Journals

Download Paper

https://doi.org/10.1016/j.compeleceng.2022.107841

Local Download

Keywords

domain generation algorithm, malware detection, generative model, machine learning, domain name system

Citation

Wang, Z. , Guo, Y. and Montgomery, D. (2022), Machine Learning-Based Algorithmically Generated Domain Detection, Computers & Electrical Engineering, [online], https://doi.org/10.1016/j.compeleceng.2022.107841, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=930537 (Accessed September 30, 2025)