Estimating the Randomness of Domain Names for DGA Bot Callbacks
Akihiro Satoh, Yutaka Nakamura, Daiki Nobayashi, Takeshi Ikenaga · IEEE Communications Letters · 2018
Bots are some of the most serious threats. Although the administrators must remove bots that reside in their networks, many bots have domain generation algorithms (DGAs) to avoid detection. A DGA is a technique for hiding the callbacks of bots by frequently changing the domain name of a command-and-control server. In this letter, we propose an approach for detecting the callbacks based on the randomness of domain names. Our evaluation indicates high performance, with a recall of 0.9960 and a precision of 0.9029. By enabling one to swiftly address various bots, our approach contributes to dramatically improving network security.