Tytuł:

Enhancing DGA Detection with Machine Learning Algorithms, Journal of Telecommunications and Information Technology, 2025, Special Issue

Tytuł publikacji grupowej:

2025, Special Issue, JTIT-artykuły

Autor:

Biros, Hubert ; Kantor, Mirosław

Temat i słowa kluczowe:

character-based DGA ; cybersecurity ; DGA detection ; DNS ; machine learning-based DGA detection ; malware analysis ; word-based DGA

Opis:

kwartalnik

Abstrakt:

The domain generation algorithm (DGA) is a popular technique used by malware to reliably establish a connection to a command and control (C&C) server. Pseudo-random domain names generated by DGA are used to bypass security measures and allow attackers to maintain control over malware-infected devices. In this work, we present a two-pronged approach to detecting character-based and word-based DGA domain names, creating classifiers specifically tailored to each type. For character-based DGA detection, we employed seven traditional machine learning methods: support vector machine, extremely randomized trees, logistic regression, Gaussian naive Bayes, nearest centroid, random forests, and k-nearest neighbors. We applied a featureful approach, using features extracted from the domain names themselves. Some of these features were drawn from existing literature, while others were newly proposed by authors. Feature selection techniques were used to retain only the best-performing ones. For the more complex task of detecting word-based DGA domain names, we used CNN and LSTM models, relying solely on word embeddings derived from the domain name components. Performance evaluation shows that proposed method gives high-performing, specialized DGA classifiers, which can be combined to create a more general-purpose classifier.

Numer:

Special Issue

Wydawca:

National Institute of Telecommunications

Data wydania:

2025, Special Issue

Typ zasobu:

artykuł

DOI:

10.26636/jtit.2025.FITCE2024.2033

eISSN:

on-line: ISSN 1899-8852

Źródło:

Journal of Telecommunications and Information Technology

Język:

ang

Prawa:

Biblioteka Naukowa Instytutu Łączności

Licencja:

CC BY 4.0