Malicious Domain Detection with Machine Learning for Financial Systems

Domain generation algorithms (DGA) create a large number of domains in order to distribute malware or send commands to targeted systems. Each domain name generated by DGA is used to create a temporary connection between attacker’s server and the targeted system. Since a targeted system tries to issue requests to any of the domains that are created by DGA, blocking DGA domains are crucial to prevent attacks. Current DGA detection mechanisms fail to detect DGA domains with high accuracy on financial systems. In this research, we propose a new model based on machine learning algorithms to detect DGA domains with high accuracy on specific financial services. We experimentally evaluated the proposed model with data that contain both known DGA and legitimate domains. We observed that the proposed model detects DGA domains with high accuracy, such as %96.2.