A high-performance domain generation algorithm domain detection model
Qizhi Zhang, Qiming Yu, Xiao Hua Yang, Ziyu Feng, Mengwei Wu · 2022
Domain Generation Algorithm (DGA) is an algorithm used by malware to generate a large number of domain names, or DGA domains, on a regular basis. This ancient but ever-active technique is the key weapon on which central structure botnets rely. In recent years, many botnets have adopted the DGA algorithm's domain transformation technique to evade detection and blocking, making it extremely difficult for security personnel to detect DGA domain names. In this article, we use the domain names of Alexa's top one million global websites as a white sample. For the DGA sample data, we take the open data of 360NetLab as the black sample to form the data set of this paper. We use 2-Gram model for feature extraction, and construct the DGA domain detection model based on the LightGBM algorithm. Experimental results show that the accuracy of our model is higher than 98%, and compared with the current common classification models, our model has better performance in both time and space.