Deep Convolutional Neural Network and Character Level Embedding for DGA Detection

João Gregório, Adriano Cansian, Leandro Neves, Denis Salvadeo

2024

Abstract

Domain generation algorithms (DGA) are algorithms that generate domain names commonly used by botnets and malware to maintain and obfuscate communication between a botclient and command and control (C2) servers. In this work, a method is proposed to detect DGAs based on the classification of short texts, highlighting the use of character-level embedding in the neural network input to obtain meta-features related to the morphology of domain names. A convolutional neural network structure has been used to extract new meta-features from the vectors provided by the embedding layer. Furthermore, relu layers have been used to zero out all non-positive values, and maxpooling layers to analyze specific parts of the obtained meta-features. The tests have been carried out using the Majestic Million dataset for examples of legitimate domains and the NetLab360 dataset for examples of DGA domains, composed of around 56 DGA families. The results obtained have an average accuracy of 99.12% and a precision rate of 99.33%. This work contributes with a natural language processing (NLP) approach to DGA detection, presents the impact of using character-level embedding, relu and maxpooling on the results obtained, and a DGA detection model based on deep neural networks, without feature engineering, with competitive metrics.

Paper Citation

in Harvard Style

Gregório J., Cansian A., Neves L. and Salvadeo D. (2024). Deep Convolutional Neural Network and Character Level Embedding for DGA Detection. In Proceedings of the 26th International Conference on Enterprise Information Systems - Volume 2: ICEIS; ISBN 978-989-758-692-7, SciTePress, pages 167-174. DOI: 10.5220/0012605700003690

in Bibtex Style

@conference{iceis24,
author={João Gregório and Adriano Cansian and Leandro Neves and Denis Salvadeo},
title={Deep Convolutional Neural Network and Character Level Embedding for DGA Detection},
booktitle={Proceedings of the 26th International Conference on Enterprise Information Systems - Volume 2: ICEIS},
year={2024},
pages={167-174},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012605700003690},
isbn={978-989-758-692-7},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 26th International Conference on Enterprise Information Systems - Volume 2: ICEIS
TI - Deep Convolutional Neural Network and Character Level Embedding for DGA Detection
SN - 978-989-758-692-7
AU - Gregório J.
AU - Cansian A.
AU - Neves L.
AU - Salvadeo D.
PY - 2024
SP - 167
EP - 174
DO - 10.5220/0012605700003690
PB - SciTePress