Loading [MathJax]/extensions/MathMenu.js
DGGCN: Dictionary based DGA detection method based on DomainGraph and GCN | IEEE Conference Publication | IEEE Xplore

DGGCN: Dictionary based DGA detection method based on DomainGraph and GCN


Abstract:

Nowadays, malware uses Algorithmically Generated Domains (AGDs) to establish communication with Command and Control (C&C) servers. Dictionary based Domain Generation Algo...Show More

Abstract:

Nowadays, malware uses Algorithmically Generated Domains (AGDs) to establish communication with Command and Control (C&C) servers. Dictionary based Domain Generation Algorithm (DGA) selects words from the frequently changed dictionaries to generate AGDs similar to benign domains, which degrades the accuracy of string based detection method. To combat this, we propose a DGA detection method based on DomainGraph and GCN (Graph Convolutional Network) which detects cross-dictionary AGDs based on the association relation between domains instead of lexical features. Starting from the association relation between domains rather than the lexical features of the domain itself, we can detect the unknown AGDs from a known AGD, regardless of the DGA dictionary they use. The proposed method exploits the fact that string association of benign domains is weak, while AGDs' association is strong. DGGCN composes a domain segmentation method, constructs a graph composed of domains (DomainGraph) based on segmentations and adopts GCN to detect AGDs. We conduct the experiments on public datasets under three settings: detecting AGDs generated by familiar dictionaries, unfamiliar dictionaries and confusing dictionaries. The results reveal that DGGCN can detect cross-dictionary AGDs similar to benign domains more accurately and robustly.
Date of Conference: 25-28 July 2022
Date Added to IEEE Xplore: 05 September 2022
ISBN Information:

ISSN Information:

Conference Location: Honolulu, HI, USA

Funding Agency:


References

References is not available for this document.