MaldomDetector: A system for detecting algorithmically generated domain names with machine learning
MaldomDetector: A system for detecting algorithmically generated domain names with machine learning
复制标题
MaldomDetector：通过机器学习检测算法生成的域名的系统
DOI：
10.1016/j.cose.2020.101787
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
S. Sezer
中科院分区：
文献类型：
--
作者：
Ahmad O. Almashhadani;M. Kaiiali;Domhnall Carlin;S. Sezer
目前网络安全的主要问题之一是不断出现复杂的攻击，如僵尸网络和勒索软件，这些攻击严重依赖命令和控制（C&C）渠道来远程进行恶意活动。为了避免信道检测，攻击者不断尝试创建不同的隐蔽通信技术。一种这样的技术是域生成算法（DGA），它允许恶意软件生成许多域名，直到它找到对应的C&C服务器。它对检测系统和逆向工程具有高度的弹性，同时允许C&C服务器具有多个冗余域名。提出了一种基于机器学习的恶意域名检测系统MaldomDetector。它能够检测基于DGA的通信，并在与C&C服务器成功连接之前规避攻击，仅使用域名的字符。MaldomDetector使用一组易于计算和语言独立的功能，以及确定性算法来检测恶意域。实验结果表明，MaldomDetector可以有效地运行作为第一报警检测基于DGA的恶意软件家族的域，同时保持高的检测精度。
One of the leading problems in cyber security at present is the unceasing emergence of sophisticated attacks, such as botnets and ransomware, that rely heavily on Command and Control (C&C) channels to conduct their malicious activities remotely. To avoid channel detection, attackers constantly try to create different covert communication techniques. One such technique is Domain Generation Algorithm (DGA), which allows malware to generate numerous domain names until it finds its corresponding C&C server. It is highly resilient to detection systems and reverse engineering, while allowing the C&C server to have several redundant domain names. This paper presents a malicious domain name detection system, MaldomDetector, which is based on machine learning. It is capable of detecting DGA-based communications and circumventing the attack before it makes any successful connection with the C&C server, using only domain name's characters. MaldomDetector uses a set of easy-to-compute and language-independent features in addition to a deterministic algorithm to detect malicious domains. The experimental results demonstrate that MaldomDetector can operate efficiently as a first alarm to detect DGA-based domains of malware families while maintaining high detection accuracy.