Abstract:Many cyber-attacks use Algorithmically Generated Domain (AGD) names to establish connections with command and control servers for subsequent attack behaviors. Identifying and blocking such AGDs helps detect and prevent attacks quickly. Traditional machine or deep learning detection methods rely only on individual domain features and face challenges in accurately distinguishing AGDs that attackers have crafted to evade detection. Thus, researchers leverage the inherent associated features among domains, clients, and resolved IP addresses to detect AGDs. In such research, heterogeneous graph neural networks are extensively employed. However, most existing methods rely on associated features, leading to inaccurate detection of isolated domain nodes. Besides, most existing detection methods employ transductive learning and are time-consuming. This paper proposes an AGD detection method, AHDom, to address these challenges. AHDom models DNS traffic as a Heterogeneous Information Network (HIN) to capture the intricate relationships between domains, clients, and resolved IP addresses. Besides, it extracts character and behavior features as initial attributes of domains to obtain an Attribute HIN (AHIN), enhancing the detection accuracy of isolated domain nodes. Based on the AHIN, it combines meta-path random walk, the inductive learning algorithm GraphSAGE, and the attention mechanism to obtain effective embedding representations of domain nodes. Ultimately, it achieves domain classification based on embedding representations of domain nodes. Our experimental results demonstrate that AHDom is superior to state-of-the-art methods in the performance and efficiency of detecting AGDs. AHDom achieves an average accuracy of 98.74% on our constructed dataset and costs only about 30.23% of the existing best graph neural network approach in the testing time.

D3N: DGA Detection with Deep-Learning Through NXDomain

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

CNN-based DGA Detection with High Coverage

Domain-Embeddings Based DGA Detection with Incremental Training Method

Towards a Deep Learning Approach for Detecting Malicious Domains

Detecting the DGA-Based Malicious Domain Names

Detection of DGA Domains Based on Support Vector Machine

BotDetector: a System for Identifying DGA-based Botnet with CNN-LSTM

Detecting DGA domains with recurrent neural networks and side information

Khaos: an Adversarial Neural Network DGA with High Anti-Detection Ability.

A Survey of Machine Learning and Deep Learning Based DGA Detection Techniques

BadDGA: Backdoor Attack on LSTM-Based Domain Generation Algorithm Detector

CODDULM: an Approach for Detecting C&C Domains of DGA on Passive DNS Traffic

Far from Classification Algorithm: Dive into the Preprocessing Stage in DGA Detection.

Fast3DS: A real-time full-convolutional malicious domain name detection system

AHDom: Algorithmically Generated Domain Detection Using Attribute Heterogeneous Graph Neural Network

Real-Time Detection of Dictionary DGA Network Traffic using Deep Learning

Detecting Dga-Based Botnet with Dns Traffic Analysis in Monitored Network

Detecting Domain Names Generated by DGAs With Low False Positives in Chinese Domain Names

HGDom: Heterogeneous Graph Convolutional Networks for Malicious Domain Detection

ReplaceDGA: BiLSTM-Based Adversarial DGA With High Anti-Detection Ability