Detection of algorithmically generated domain names used by botnets

计算机科学 人工智能 僵尸网络 机器学习 深度学习 特征工程 恶意软件 随机森林 分类器(UML) 水准点(测量) 人工神经网络 学习分类器系统 特征提取 互联网 操作系统 大地测量学 万维网 地理
作者
Jan Spooren,Davy Preuveneers,Lieven Desmet,Peter H. Janssen,Wouter Joosen
标识
DOI:10.1145/3297280.3297467
摘要

Malware typically uses Domain Generation Algorithms (DGAs) as a mechanism to contact their Command and Control server. In recent years, different approaches to automatically detect generated domain names have been proposed, based on machine learning. The first problem that we address is the difficulty to systematically compare these DGA detection algorithms due to the lack of an independent benchmark. The second problem that we investigate is the difficulty for an adversary to circumvent these classifiers when the machine learning models backing these DGA-detectors are known. In this paper we compare two different approaches on the same set of DGAs: classical machine learning using manually engineered features and a 'deep learning' recurrent neural network. We show that the deep learning approach performs consistently better on all of the tested DGAs, with an average classification accuracy of 98.7% versus 93.8% for the manually engineered features. We also show that one of the dangers of manual feature engineering is that DGAs can adapt their strategy, based on knowledge of the features used to detect them. To demonstrate this, we use the knowledge of the used feature set to design a new DGA which makes the random forest classifier powerless with a classification accuracy of 59.9%. The deep learning classifier is also (albeit less) affected, reducing its accuracy to 85.5%.
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
PDF的下载单位、IP信息已删除 (2025-6-4)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
lxdfrank完成签到,获得积分10
1秒前
1秒前
orixero应助饱满南松采纳,获得10
2秒前
2秒前
失眠无声发布了新的文献求助10
2秒前
chen发布了新的文献求助10
3秒前
wjx关闭了wjx文献求助
3秒前
Gemini完成签到,获得积分10
4秒前
5秒前
橘子应助蘑菇丰收采纳,获得10
7秒前
LI发布了新的文献求助30
7秒前
7秒前
wjx关闭了wjx文献求助
7秒前
8秒前
8秒前
9秒前
可爱的函函应助执着沛蓝采纳,获得10
10秒前
852应助失眠无声采纳,获得10
10秒前
wjx关闭了wjx文献求助
11秒前
恒123发布了新的文献求助10
12秒前
江夏清发布了新的文献求助10
13秒前
15秒前
15秒前
赘婿应助123采纳,获得10
15秒前
量子星尘发布了新的文献求助10
16秒前
18秒前
柯一一应助科研通管家采纳,获得10
18秒前
彭于晏应助科研通管家采纳,获得10
18秒前
完美世界应助科研通管家采纳,获得10
18秒前
yar应助科研通管家采纳,获得10
19秒前
orixero应助科研通管家采纳,获得10
19秒前
小二郎应助科研通管家采纳,获得10
19秒前
yar应助科研通管家采纳,获得10
19秒前
yar应助科研通管家采纳,获得10
19秒前
wjx关闭了wjx文献求助
21秒前
搜集达人应助江夏清采纳,获得10
21秒前
香蕉你个笨啦啦完成签到,获得积分10
22秒前
23秒前
onlyan发布了新的文献求助10
24秒前
25秒前
高分求助中
A new approach to the extrapolation of accelerated life test data 1000
Picture Books with Same-sex Parented Families: Unintentional Censorship 700
ACSM’s Guidelines for Exercise Testing and Prescription, 12th edition 500
Nucleophilic substitution in azasydnone-modified dinitroanisoles 500
不知道标题是什么 500
Indomethacinのヒトにおける経皮吸収 400
Phylogenetic study of the order Polydesmida (Myriapoda: Diplopoda) 370
热门求助领域 (近24小时)
化学 材料科学 医学 生物 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 遗传学 基因 物理化学 催化作用 冶金 细胞生物学 免疫学
热门帖子
关注 科研通微信公众号,转发送积分 3975375
求助须知:如何正确求助?哪些是违规求助? 3519718
关于积分的说明 11199471
捐赠科研通 3256067
什么是DOI,文献DOI怎么找? 1798075
邀请新用户注册赠送积分活动 877386
科研通“疑难数据库(出版商)”最低求助积分说明 806305