Automatic Algorithmically Generated Domain Detection with Deep Learning Methods

Domain-Flux is the main way for malware or botnets to bypass most detection systems where static methods, such as blacklists, are relied on. The key point of Domain-Flux is Domain Generation Algorithm (DGA), which can generate thousands of domain names in a short time. Therefore, effective detection of DGA domain names plays an important role in cybersecurity defense. Traditional detection methods mainly depend on the reverse engineering of malware samples, which is tedious and inflexible. In this paper, we apply artificial intelligence methods in this field and detect DGA domains automatically. Specifically, we first discover the pseudo-randomness of DGA domain name strings through data analysis. Then, we build several DGA classifiers based on different machine learning and deep learning methods. Apart from separating DGA domains from benign ones, classifiers with deep learning models can also support multi-classification and identify DGA families. Finally, the experiment results on a well-known public dataset show that the classifier with CNN model is superior to the others with the consideration of accuracy, efficiency and robustness.