Detecting algorithmically generated malicious domain names

By Sandeep Yadav, Ashwath Kumar Krishna Reddy, A. L. Narasimha Reddy, Supranamaya Ranjan. ACM/SIGCOMM Internet Measurement Conference, 2010

388 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

View Paper: https://www.semanticscholar.org/paper/0781d1e2c2027794393eb33cc08d60fff2940c32

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

Finding and Characterizing Information Warfare Campaigns (2020, methodology): “These teams have separately used Kullback-Leibler Divergence [258], a dictionary approach [178] and Markov modeling [196].”
Proactive Discovery of Phishing Related Domain Names (2012, methodology): “In [27], statistical measures are applied to alphanumeric characters distribution and bigrams distribution in URLs in order to detect algorithmically generated ﬂuxing domains.”
Malicious URL Detection using Machine Learning: A Survey (2017, background): “For the 2 million URLs, [28] obtained over a million host-based features.”
From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware (2012, background): “Their experiments showed that the first approach was ineffective, as several legitimate services use DNS with short time-to-live (TTL) values.”
EvilSeed: A Guided Approach to Finding Malicious Web Pages (2012, background): “These characteristics can be used to identify additional (previously uncategorized) domains that are likely to be malicious [5], [45]–[47].”
DeepDGA: Adversarially-Tuned Domain Generation and Detection (2016, methodology): “Previous works include using a Hidden Markov Model (HMM) framework to model the generating distribution of several DGA families as well as “normal“ domains [3], and making bulk predictions on large sets of domains using clustering as a ﬁltering technique [4], [5].”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “Another branch of research aims to detect dynamically generated malicious domains by modeling their lexical structures and utilizing the high number of failed DNS queries observed in botnets using such domains [7, 38, 39].”