Abstract:Botnets have become one of the main threats to cyberspace security currently. More and more bots utilize the domain generation algorithm (DGA) to generate malicious domain names to communicate with Command & Control (C&C) servers. A well-designed DGA can bypass the traditional detection methods such as sinkhole and rule filtering, which raises new challenges to cyberspace security. In the field of machine learning, the n-gram is a semantic model that characterizes the relationship among neighboring morphemes while deep convolutional neural networks have a robust capability in processing information with translation-invariant properties. In this paper, we combined n-gram and a deep convolutional neural network and then proposed a novel n-gram combined character based domain classification (n-CBDC) model. The n-CBDC model runs in an end-to-end way that doesn’t require hand-extracted features or domain name system (DNS) contextual information; it only needs to input the domain name itself and can automatically estimate the probability that the domain name was generated by DGAs. Experiments on real-world data show that the proposed method can effectively detect domain names generated by DGAs with 98.69% average detection rate and 0.9829 average F-measure, and significantly outperformed the state-of-art methods in detecting pronounceable and wordlist-based DGA domain names with more than 93.89% detection rate. Therefore, the proposed detection method is robust and has a wide range of adaptability in detecting various types of domain names generated by DGAs.

Garlic: A Distributed Botnets Suppression System

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

A Collaborative Botnets Suppression System Based on Overlay Network.

Cooperation System of Worm Detection and Quarantine in Real Time

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Characterizing the IRC-based Botnet Phenomenon

A Distributed Botnet Detecting Approach Based on Traffic Flow Analysis

Efficient Detect Scheme of Botnet Command and Control Communication.

CCGA: Clustering and Capturing Group Activities for DGA-Based Botnets Detection

CONDENSER: A Graph-Based Approachfor Detecting Botnets

Botnet Detection Technology Based On Dns

A Novel Irc Botnet Detection Method Based On Packet Size Sequence

Distributed Threat Intelligence Sharing System: A New Sight of P2P Botnet Detection

Tracking and Characterizing Botnets Using Automatically Generated Domains

Zero Botnets: An Observe-Pursue-Counter Approach

BlockchainBot: A Novel Botnet Infrastructure Enhanced by Blockchain Technology and IoT

Research on Key Technologies and Defenses of Botnet

BotGraph: Large Scale Spamming Botnet Detection

BotMeter: Charting DGA-Botnet Landscapes in Large Networks.

Detection of Peer-to-Peer Botnets

Investigation on the Botnets Activities