Abstract:The botnet relies on the Command and Control (C&C) channels to conduct its malicious activities remotely. The Domain Generation Algorithm (DGA) is often used by botnets to hide their Command and Control (C&C) server and evade take-down attempts, which allows the bot to generate a large number of domain names until it finds its C&C server. The lengths of domain names generated by DGAs are different. Our research finds that the length of the domain name has an impact on the performance of the DGA domain name detection model. In other words, the model is sensitive to the length of the domain name. In this case, attackers can evade detection simply by designing domain names of specific lengths. Moreover, the detection accuracy of DGA domain names still needs to be further improved. To solve these problems, three feature extraction methods adapted to the length of the domain name are proposed in this paper. For extra-short domain names, we use the attention-based method to extract features, which can make use of the character-level semantic feature. For moderate-length domain names, a two-dimensional structure, namely Right Shifted Tensor (RST), is constructed to make the domain name present apparent features similar to images. For the extra-long domain name, the effective classification of domain names can be achieved by manually crafted easy-to-calculate features. Then, different detection structures are designed based on these tree feature extraction methods to form a heterogeneous DGA detection model, namely HAGDetector. In addition, the public suffix is an important part of the domain name. We further analyze the public suffix to evaluate its impact on the detection of DGA domain names. Finally, the experiments are conducted to assess the validity of HAGDetector, as well as compare our approach with the current state-of-the-art and highlight the impact of the domain name length. The experimental results show that our method greatly improves the detection performance.

AHDom: Algorithmically Generated Domain Detection Using Attribute Heterogeneous Graph Neural Network

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

CNN-based DGA Detection with High Coverage

HGDom: Heterogeneous Graph Convolutional Networks for Malicious Domain Detection

Towards Accurate DGA Detection Based on Siamese Network with Insufficient Training Samples

AGCN-Domain: Detecting Malicious Domains with Graph Convolutional Network and Attention Mechanism

DGGCN: Dictionary Based DGA Detection Method Based on DomainGraph and GCN

HAGDetector: Heterogeneous DGA domain name detection model

Deepdom: Malicious Domain Detection with Scalable and Heterogeneous Graph Convolutional Networks

Domain-Embeddings Based DGA Detection with Incremental Training Method

Detecting Malicious Domain Names Based on AGD

Themis: A Novel Detection Approach for Detecting Mixed Algorithmically Generated Domains

AGDB: A Dictionary-based Malicious Domain Detection Method Based on Representation Fusion

HANDOM : Heterogeneous Attention Network Model for Malicious Domain Detection

D3N: DGA Detection with Deep-Learning Through NXDomain

Khaos: an Adversarial Neural Network DGA with High Anti-Detection Ability.

Detecting the DGA-Based Malicious Domain Names

BotDetector: a System for Identifying DGA-based Botnet with CNN-LSTM

Detecting Dictionary Based AGDs Based on Community Detection.

Heterogeneous Domain Adaptation for IoT Intrusion Detection: A Geometric Graph Alignment Approach

Accurate Anomaly Detection Leveraging Knowledge-enhanced GAT