DeepDGA: Adversarially-Tuned Domain Generation and Detection

By H. S. Anderson, Jonathan Woodbridge, Bobby Filar. 2016

223 citations recorded by the source corpus.

Many malware families utilize domain generation algorithms (DGAs) to establish command and control (C&C) connections. While there are many methods to pseudorandomly generate domains, we focus in this paper on detecting (and generating) domains on a per-domain basis which provides a simple and flexible means to detect known DGA families. Recent machine learning approaches to DGA detection have been successful on fairly simplistic DGAs, many of which produce names of fixed length. However, models trained on limited datasets are somewhat blind to new DGA variants. In this paper, we leverage the concept of generative adversarial networks to construct a deep learning based DGA that is designed to intentionally bypass a deep learning based detector. In a series of adversarial rounds, the generator learns to generate domain names that are increasingly more difficult to detect. In turn, a detector model updates its parameters to compensate for the adversarially generated domains. We test the hypothesis of whether adversarially generated domains may be used to augment training sets in order to harden other machine learning models against yet-to-be-observed DGAs. We detail solutions to several challenges in training this character-based generative adversarial network. In particular, our deep learning architecture begins as a domain name auto-encoder (encoder + decoder) trained on domains in the Alexa one million. Then the encoder and decoder are reassembled competitively in a generative adversarial network (detector + generator), with novel neural architectures and training strategies to improve convergence.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Adversarial Examples: Attacks and Defenses for Deep Learning (2017, methodology): “[95] used GAN to generate adversarial domain names to evade the detection of domain generation TABLE III”
Constructing Unrestricted Adversarial Examples with Generative Models (2018, neutral): “The closest to our work are AdvGAN and DeepDGA.”
Adversary Resistant Deep Neural Networks with an Application to Malware Detection (2016, background): “Recent research has demonstrated that malware detection approaches based on deep neural networks (DNNs) can recognize abstract complex pa erns from a large amount of malware samples. is could o er a far be er way to detect all types of malware, even in instances of heavy mutation [2, 7, 8, 14, 17–19”
Automated Crowdturfing Attacks and Defenses in Online Review Systems (2017, methodology): “This includes proposals to automatically solve CAPTCHAs using Convolutional Neural Networks [13, 60], and automatically generate malware domains using Generative Adversarial Networks [1].”
A Survey of Deep Learning Methods for Cyber Security (2019, methodology): “GAN Anderson, Woodbridge and Filar [107] 23 DGA Alexa [60]”
Evading Machine Learning Malware Detection (2017, methodology): “Some of this work has been generally devoted to evading models that detect malware (Android, PDF malware, Windows PE) or malware behavior (detecting domain generation algorithms) [10, 1, 23, 11].”
Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning (2018, methodology): “[2] apply this GAN-based attack to a detector of domain generation algorithm (DGA) domains, which attempts to distinguish human-crafted from algorithmically-generated domain names.”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, background): “Some other works (Hu & Tan, 2017; Anderson et al., 2016) consider using GANs (Goodfellow et al., 2014a) to generate adversarial malware.”