Intelligent System for Classification of DGA Botnets Using Machine Learning Algorithms

Author

Ruth Ofoh, Ugwu C., Eke B. O

Abstract

 In this work, the aim is to classify wordlist DGA and distinguish it from other DGA types. Different features were extracted from domain names to represent them for model training. Domains were cleaned and tokenized at character level. Word2Vec embeddings were trained on the domain characters to capture patterns in character sequences. Auxiliary features were also calculated, such as domain length, entropy, digit ratio, vowel ratio, and special character ratio. These features together created a feature space that included both semantic information from Word2Vec and structural information from auxiliary metrics. This helped models to see differences between normal domains and generated domains. Machine learning models were trained on these features. Machine learning models included KNN, SVM, Random Forest, Decision Tree, Gradient Boosting, and Logistic Regression. The models used the Word2Vec embeddings plus auxiliary features. An autoencoder was also trained to learn the latent structure of domains and compute reconstruction error for anomaly detection. This helped in identifying domains with unusual patterns. Evaluation of models showed that the AUC, representing the model’s ability to distinguish between legitimate and DGA domains across thresholds, is highest at 0.88 for Random Forest and lowest at 0.82 for both SVM and Decision Tree. This shows the model can learn complex patterns in the domain sequences and generalize well. The system was implemented in a Gradio interface to allow interactive domain testing. The interface allows a user to enter a domain and get the predicted class, auxiliary feature values, probability for each class, wordcloud visualization, and autoencoder loss curve,. The autoencoder threshold provided insight into abnormal domain structure and added explainability. Overall, the combination of Word2Vec embeddings, auxiliary features, and the Machine learning model provided a robust and explainable system for classifying domains.

Keywords

Autoencoder botnet, word2vec, botmaster, machine learning

Full Text:

Download Paper PDF

References

Alieyan, K., ALmomani, A., Manasrah, A., & Kadhum, M. M. (2017). A survey of botnet detection based on DNS. Neural Computing and Applications, 28, 1541-1558.

Alauthman, M., Aslam, N., Al-Kasassbeh, M., Khan, S., Al-Qerem, A., & Choo, K. K. R. (2020). An efficient reinforcement learning-based Botnet detection approach. Journal of Network and Computer Applications, 150, 102479.

Banerjee, M., & Samantaray, S. (2019). Network traffic analysis based iot botnet detection using honeynet data applying classification techniques. International Journal of Computer Science and Information Security (IJCSIS), 17(8).

Bilge, L., Sen, S., Balzarotti, D., Kirda, E., & Kruegel, C. (2014). Exposure: A passive dns analysis service to detect and report malicious domains. ACM Transactions on Information and System Security (TISSEC), 16(4), 1-28.

Catillo, M., Pecchia, A., & Villano, U. (2022, August). Botnet detection in the internet of things through all-in-one deep autoencoding. In Proceedings of the 17th International Conference on Availability, Reliability and Security (pp. 1-7).

Charan, P. S., Shukla, S. K., & Anand, P. M. (2020). Detecting word based DGA domains using ensemble models. In Cryptology and Network Security: 19th International Conference, CANS 2020, Vienna, Austria, December 14–16, 2020, Proceedings 19 (pp. 127-143).

Hoang, X.D., & Nguyen, Q. C. (2018). Botnet detection based on machine learning techniques using DNS query data. Future Internet, 10(5), 43.

Huong, T. T., Bac, T. P., Long, D. M., Thang, B. D., Binh, N. T., Luong, T. D., & Phuc, T. K. (2021). Lockedge: Low-complexity cyberattack detection in iot edge computing. IEEE Access, 9, 29696-29710.

Li, X., Wang, J., & Zhang, X. (2017). Botnet detection technology based on DNS. Journal Future Internet, (2017(9), 55. https://doi.org/10.3390/fi9040055

Liang, Z., Zang, T., & Zeng, Y. (2020, May). Malportrait: Sketch malicious domain portraits based on passive DNS data. In 2020 IEEE Wireless Communications and Networking Conference (WCNC) (pp. 1-8).

Mikolov, T., Chen, K., Corrado, G., & Dean, J. (2013). Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781.Namgung, J., Son, S., & Moon, Y. S. (2021). Efficient deep learning models for DGA domain detection. Security and Communication Networks, 2021(1), 8887881.

Silva, S. S., Silva, R. M., Pinto, R. C., & Salles, R. M. (2013). Botnets: A survey. Computer Networks, 57(2), 378-403.

Shinan, K., Alsubhi, K., Alzahrani, A., & Ashraf, M. U. (2021). Machine learning-based botnet detection in software-defined network: a systematic review. Symmetry, 13(5), 866.

Umar, M., Abisoye, O. A., & Ganiyu, S. O. (2021). A Literature Survey on IoT Botnet Detection Techniques. 4th International Conference on Information Technology in Education and Development 2021.

Vranken, H., & Alizadeh, H. (2022). Detection of DGA-generated domain names with TF-IDF. Electronics, 11(3), 414.

Zeng, J., Tang, W., Liu, C., Hu, J., & Peng, L. (2012). Efficient detect scheme of botnet command and control communication. In Information Computing and Applications: Third International Conference, ICICA 2012, Chengde, China, September 14-16, 2012. Proceedings, Part I 3 (pp. 576-581).

Xu, C., Shen, J., & Du, X. (2019). Detection method of domain names generated by DGAs based on semantic representation and deep neural network. Computers & Security, 85, 77-88.

 

 

 

Share your valuable work from Social Media Buttons