Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Machine Learning-Based Algorithmically Generated Domain Detection

Published

Author(s)

Zheng Wang, Yang Guo, Douglas Montgomery

Abstract

Malware like botnets typically uses domain generation algorithms (DGAs) to dynamically produce a large number of random algorithmically generated domains (AGDs) and use a few of them to communicate with the command and control servers. AGD detection provides a lightweight yet effective solution to the threats imposed by DGA-based malware. For example, the linguistic distance between domain names was found as the promising metric to identify AGDs from benign domains. However, the distance metrics are not informatively enough used by the conventional approach. We propose to use machine learning algorithms on the distance metrics. Feature engineering techniques are proposed to boost detection performance. The results show that our proposal can outperform the existing algorithms, with a detection accuracy of over 99% for the tested DGAs. The permutation feature importance analysis is presented for explainability. The deployment locations of the AGD detectors are discussed.
Citation
Computers & Electrical Engineering
Volume
100

Keywords

domain generation algorithm, malware detection, generative model, machine learning, domain name system

Citation

Wang, Z. , Guo, Y. and Montgomery, D. (2022), Machine Learning-Based Algorithmically Generated Domain Detection, Computers & Electrical Engineering, [online], https://doi.org/10.1016/j.compeleceng.2022.107841 (Accessed June 29, 2022)
Created May 1, 2022, Updated June 12, 2022