A model to detect domain names generated by DGA malware
T. L. Divya, P. P. Amritha, Sangeetha Viswanathan · Procedia Computer Science · 2022
Command and control(C&C) servers are being more frequently used in cyberattacks in recent years. A malware-infected machine is controlled and directed by an attacker using a command-and-control server in order to steal data from the network. To hide their servers, attackers commonly employ a domain generation algorithm that generates domain names for them by concatenating words from word lists. Some of the algorithmically-generated domain names are used to connect to the C&C server. With the emergence of sophisticated domain generation algorithms, detecting such domains has become a challenge, which in turn poses a severe danger to computer networks. In this paper, we are proposing a concept called centrality, which is used as one of the features to analyze the words in the domain names generated by the domain generation algorithm malware. For classification, we are using Naïve Bayes, KNN, SVM, Decision Trees, Random Forest and logistic regression. Experimental results showed that Random Forest gave the highest classification accuracy rate of 88.64% and Naive Bayes gave the lowest accuracy of 44.32%.