Identification of Legitimate Domain Names Using Classification Algorithm and Ngram Model

The network of computers infected with malicious software without the knowledge of owner is termed as Botnets. Cyber criminals use these botnets for malicious activities such as Distributed Denial of Service attacks, blagging of sensitive data. Recent botnets namely zeus, kraken, Nargache and many others apply a technique called DGA (Domain Generated Algorithms). DGA dynamically generates large number of random domains and choose subset for use so that static domains remains ineffective. The legitimate and DGA domains identification are often understood as most difficult to identify. The proposed work deals with the identification of legitimate domains from DGA generated ones using Classification models and N-Gram models. The introduction of N-Gram model with classification model achieves much accuracy.