Abstract:A botnet is a network of remote-controlled devices that are infected with malware controlled by botmasters in order to launch cyber attacks. To evade detection, the botmaster frequently changes the domain name of his Command and Control (C&C) server. Notice that most of these types of domain names are generated by domain generation algorithms (DGAs). In this paper, we propose Khaos, a novel DGA with high anti-detection ability based on neural language models and the Wasserstein Generative Adversarial Network (WGAN). The key insight of our research is that real domain names are composed of readable syllables and acronyms, and thus we can arrange syllables and acronyms using neural language models to mimic real domain names. In Khaos, we first find the most common n-grams in real domain names, then tokenize these domain names into n-grams, and finally synthesize new domain names after learning arrangements of n-grams from real domain names. We carry out experiments using a variety of state-of-the-art DGA detection approaches: the statistics-based, the distribution-based, the LSTM-based and the graph-based detection approach. Our experimental results show that the average distance for detecting Khaos under the distribution-based detection approach is 0.64, the AUCs of Khaos under the statistics-based and the LSTM-based detection approach are 0.76 and 0.57, respectively, and the precision of Khaos under the graph-based detection approach is 0.68. Our work proves that the existing detection approaches have big troubles in detecting Khaos, and Khaos has better anti-detection ability than state-of-the-art DGAs. In addition, we find that training the existing detection approach on a dataset including the domain names generated by Khaos can improve its detection ability.

A Two-Stream Network Based on Capsule Networks and Sliced Recurrent Neural Networks for DGA Botnet Detection

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

CNN-based DGA Detection with High Coverage

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Botnet DGA Domain Name Classification Using Transformer Network with Hybrid Embedding

BotDetector: a System for Identifying DGA-based Botnet with CNN-LSTM

DGA botnet detection method based on capsule network and k-means routing

Botnet Detection Based on Generative Adversarial Network

An Improved Capsule Network for DGA Domain Detection

Bot-DM: A dual-modal botnet detection method based on the combination of implicit semantic expression and graphical expression

Domain-Embeddings Based DGA Detection with Incremental Training Method

Uit-DGAdetector: detect domains generated by algorithms using machine learning

CCGA: Clustering and Capturing Group Activities for DGA-Based Botnets Detection

Real-Time Detection of Dictionary DGA Network Traffic using Deep Learning

Khaos: an Adversarial Neural Network DGA with High Anti-Detection Ability.

Multi-attributed heterogeneous graph convolutional network for bot detection

CI_GRU: an Efficient DGA Botnet Classification Model Based on an Attention Recurrence Plot.

A Simple Recurrent Unit Model Based Intrusion Detection System with DCGAN

DGA-Based Botnet Detection Toward Imbalanced Multiclass Learning

Detection of DGA Domains Based on Support Vector Machine

Deep fused flow and topology features for botnet detection basing on pretrained GCN