Domain generation algorithms detection with feature extraction and Domain Center construction.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Network attacks increasingly utilize Command and Control (C&C) servers.
• Domain Generation Algorithms (DGA) are employed by attackers to obscure C&C server domains.
• Existing DGA detection methods using limited domain name features show constrained effectiveness.

Purpose of the Study:

• To enhance the accuracy and efficiency of DGA domain detection.
• To overcome the limitations of feature sets solely based on domain names.
• To develop a robust deep learning model for identifying DGA domains.

Main Methods:

• Extraction of domain name, Whois, and N-gram features for DGA detection.
• Construction of domain name whitelist and blacklist substring feature sets for N-gram feature generation.
• Development of a deep learning model integrating BiLSTM, Attention, and CNN architectures.
• Implementation of a Domain Center for rapid domain classification.

Main Results:

• The proposed model achieved superior performance in Accuracy, Precision, Recall, and F1-score compared to existing methods.
• Significant reduction in DGA domain detection time was observed.
• The integrated feature set and deep learning approach proved highly effective.

Conclusions:

• The novel approach effectively addresses the limitations of previous DGA detection techniques.
• The developed deep learning model offers a powerful tool for real-time cybersecurity threat detection.
• Enhanced feature engineering and advanced deep learning architectures are crucial for robust DGA detection.