Detecting Domain Generation Algorithms in Malware Traffic Using Constrained Resources

A large number of malware samples use Domain Generation Algorithms (DGA) for locating and connecting to the Command and Control server. This technique enables the malware authors to avoid the C&C domain being seized and makes it difficult for security solutions to blacklist all the possible generated domains. Since the malicious actors register only a small fraction of the generated domains, DGA-enabled malware will generate a large number of unresolved DNS queries. Unfortunately, security solutions cannot rely solely on this heuristic, as computing systems can also produce unresolved DNS queries for benign reasons. Checking whether an unresolved domain is generated by a DGA can be done using Machine Learning algorithms, but the model usually requires high computing power, either locally or in the cloud. We propose a low footprint Machine Learning model that is able to detect generated malicious domains without the need for a great deal of memory and overall computational power. Furthermore, our model enables resource-constrained devices such as home routers to protect themselves and the local network. The experimental results show that our model has a close performance to the state-of-the-art classifiers while using just a fraction of their resources.