Classification of DGA Botnet Detection and Their Families Using LSTM-Attention

Botnets represent a significant threat to network security, capable of initiating denial of service (DoS) attacks and spreading malware and spam on a large scale. Botnet evolved by using Domain Generation Algorithm (DGA) to avoid sinkholing, blacklisting, and evading security systems. DGA-based botnets are capable of producing a large number of pseudo-random domains and selecting a subset to communicate with via the Command and Control (C&C) server. Several LSTM-based botnet detection approaches have been proposed. Differing from previous studies, this study proposes LSTM with an attention layer and a two-stage classification process to maximize feature extraction from the DGA and address the complexity of the DGA family and imbalance sample. The experimental results demonstrate that the model can detect botnets from a domain with precision, recall, F1, and accuracy scores of 0.9905, 0.9894, 0.9899, 0.9901 respectively. These scores indicate that the model performs well in botnet classification.