Classification of DGA-Based Malware Using Deep Hybrid Learning

Attackers use a domain generation algorithm (DGA) to generate a large number of random domain names that act as rendezvous points. These domain names create a command-and-control channel between the attackers and their malware, enabling the hackers to send any command to the malware. Detecting such domain names is challenging as they mimic the pattern of normal domain names, making it difficult to attribute specific malware-generating domains. Moreover, detecting DGA-based domain names faces the issue of poor performance in detecting zero-day malware. Our study uses a hybrid deep learning model with machine learning algorithms that automatically learn features from given domain name data. We used CNN and LSTM deep learning algorithms as feature extractors and seven machine learning algorithms, namely Logistic Regression (LR), Naive Bayes (NB), Decision Tree (DT), Random Forest (RF), Extra Trees (ET), AdaBoost (AB), and Extreme Gradient Boosting (XGB), for the final classification experiments to solve both binary and multiclass problems. Our findings indicate that the hybrid model of LSTM with the random forest algorithm scored 99% detection accuracy and 99.8% AUC score in binary experiments and detection accuracy of 99% and 99.65% AUC score in grouped multiclass classification experiments. Grouping domain families based on their character distribution gives better results than trying to detect families individually.