Abstract:Malicious domains pose a severe threat to cybersecurity. As to improve the detection accuracy when the malicious domain variants increase, we proposed a novel malicious domain detection method named MDND‐SS‐PO that combines semi‐supervised learning and parameter optimization. The method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. And an improved DBSCAN based on the neighborhood division is applied semi‐supervised learning with less label efforts. Finally, Gaussian process regression is used to optimize parameter settings of machine learning algorithms. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%. Malicious domains provide malware with covert communication channels which poses a severe threat to cybersecurity. Despite the continuous progress in detecting malicious domains with various machine learning algorithms, maintaining up‐to‐date various samples with fine‐labeled data for training is difficult. To handle these issues and improve the detection accuracy, a novel malicious domain detection method named MDND‐SS‐PO is proposed that combines semi‐supervised learning and parameter optimization. The contributions of the study are as follows. First, the method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. Second, an improved DBSCAN based on the neighborhood division is designed to cluster labeled data and unlabeled data with low time consumption. Then, based on the clustering hypothesis, unlabeled data is tagged with pseudo‐label according to the cluster results, which aims to train a supervised classifier effectively. Finally, Gaussian process regression is used to optimize parameter settings of the algorithm. And the Silhouette index and F1 score are introduced to evaluate the optimization results. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%.

Detection of Algorithmically Generated Malicious Domain Names with Feature Fusion of Meaningful Word Segmentation and N-Gram Sequences

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

CNN-based DGA Detection with High Coverage

Detecting Dictionary Based AGDs Based on Community Detection.

Word-Map: Using Community Detection Algorithm to Detect AGDs

DGGCN: Dictionary Based DGA Detection Method Based on DomainGraph and GCN

Detecting Domain Names Generated by DGAs With Low False Positives in Chinese Domain Names

Domain-Embeddings Based DGA Detection with Incremental Training Method

Detecting DGA domains with recurrent neural networks and side information

HAGDetector: Heterogeneous DGA domain name detection model

ReplaceDGA: BiLSTM-Based Adversarial DGA With High Anti-Detection Ability

Using Extended Character Feature in Bi-LSTM for DGA Domain Name Detection

Advances in artificial intelligence for detecting algorithmically generated domains: Current trends and future prospects

Botnet DGA Domain Name Classification Using Transformer Network with Hybrid Embedding

Unsupervised Clustering for a Comparative Methodology of Machine Learning Models to Detect Domain-Generated Algorithms Based on an Alphanumeric Features Analysis

Malicious domain detection based on semi‐supervised learning and parameter optimization

AGCN-Domain: Detecting Malicious Domains with Graph Convolutional Network and Attention Mechanism

D3N: DGA Detection with Deep-Learning Through NXDomain

Illegal Domain Name Generation Algorithm Based on Character Similarity of Domain Name Structure

Khaos: an Adversarial Neural Network DGA with High Anti-Detection Ability.

Real-Time Detection of Dictionary DGA Network Traffic using Deep Learning