An Approach for Identifying Malicious Domain Names Automatically Generated by DGA Malware

DOI IR IR (HANDLE) IPSJ

Bibliographic Information

Other Title
  • DGAマルウェアにより自動生成された悪性ドメインの判別

Search this article

Description

Some of the most serious security threats facing computer networks involve malware. Many types of malware have DGAs (Domain Generation Algorithms) to avoid detection. A DGA is a mechanism for hiding the callback communications of malware by frequently changing the domain name of a C&C (Command-and-Control Server). In this paper, we attempt to detect the callback communications of DGA malware by superficially analyzing domain names. Our approach distinguishes between benign and malicious domains based on the meaning of their character string and does not require any prior knowledge about the DGAs. Our evaluation indicates high performance, with a recall of 0.9960 and a precision of 0.9029. By enabling one to swiftly address various malware, our approach contributes to dramatically improving network security.

Journal

Related Projects

See more

Keywords

Details 詳細情報について

Report a problem

Back to top