Down to earth! Guidelines for DGA-based Malware Detection
Bogdan Cebere, Jonathan Lasse Bennet Flueren, Silvia Sebastián, Daniel Plohmann, Christian Rossow · 2024
Successful malware campaigns rely on Command-and-Control (C2) infrastructure, enabling attackers to extract sensitive data and give instructions to bots. As a resilient mechanism to obtain C2 endpoints, attackers can employ Domain Generation Algorithms (DGAs), which automatically generate C2 domains instead of relying on static ones. Thus, researchers have proposed network-level detection approaches that reveal DGA usage by differentiating between non-DGA and generated domains. Recent approaches train machine learning (ML) models to recognize DGA domains using pattern recognition at the domain’s character level.