DGA domain detection using pretrained character based transformer models
Bronjon Gogoi, Tasiruddin Ahmed · 2023
DGAs (Domain Generation Algorithms) are a class of algorithms used by Malwares for generating pseudorandom domain names. The generated pseudorandom domain names are used by Malwares for communicating with C&Cs (Command and Control Centre) to receive updates and other critical information. The pseudorandom nature of the generated domain names makes it harder for traditional security measures like firewalls to detect the communication between Malwares and the C&Cs. Other traditional defense mechanisms like blocklists are also not effective as it is difficult and time-consuming to maintain an ever-growing list of malicious domains. To eliminate these deficiencies of the traditional approach, many machine learning and deep learning approach have been proposed for the detection of DGA-generated domain names. In this paper, we proposed a pretrained transformer-based approach to detecting DGA-generated domain names. Our approach aims to see if a given domain name is a DGA-generated domain name or a benign domain name based only on the domain name. The proposed approach was tested on a 1 million dataset containing DGA-generated and benign domain names. The results demonstrated a remarkable accuracy of 0.99, affirming the effectiveness of pretrained transformer-based models in the binary classification of domain names into benign and DGA categories.