Back close

DBD: Deep Learning DGA-Based Botnet Detection

Publication Type : Book Chapter

Publisher : Springer International Publishing,

Source : Deep Learning Applications for Cyber Security, Springer International Publishing, Cham, p.127–149 (2019)

Url :

ISBN : 9783030130572

Keywords : Botnet, Cyber security, Cybercrime, Deep learning, Domain name generation, Domain-flux, Keras embedding, malware

Campus : Coimbatore

School : School of Engineering

Center : Computational Engineering and Networking

Department : Electronics and Communication

Year : 2019

Abstract : Botnets play an important role in malware distribution and they are widely used for spreading malicious activities in the Internet. The study of the literature shows that a large subset of botnets use DNS poisoning to spread out malicious activities and that there are various methods for their detection using DNS queries. However, since botnets generate domain names quite frequently, the resolution of domain names can be very time consuming. Hence, the detection of botnets can be extremely difficult. This chapter propose a novel deep learning framework to detect malicious domains generated by malicious Domain Generation Algorithms (DGA). The proposed DGA detection method, named, Deep Bot Detect (DBD) is able to evaluate data from large scale networks without reverse engineering or performing Non-Existent Domain (NXDomain) inspection. The framework analyzes domain names and categorizes them using statistical features, which are extracted implicitly through deep learning architectures. The framework is tested and deployed in our lab environment. The experimental results demonstrate the effectiveness of the proposed framework and shows that the proposed method has high accuracy and low false-positive rates. The proposed framework is a simple architecture that contains fewer learnable parameters compared to other character-based, short text classification models. Therefore, the proposed framework is faster to train and is less prone to over-fitting. The framework provides an early detection mechanism for the identification of Domain-Flux botnets propagating in a network and it helps keep the Internet clean from related malicious activities.

Cite this Research Publication : R. Vinayakumar, Dr. Soman K. P., Poornachandran, P., Alazab, M., and Jolfaei, A., “DBD: Deep Learning DGA-Based Botnet Detection”, in Deep Learning Applications for Cyber Security, M. Alazab and Tang, M. J., Eds. Cham: Springer International Publishing, 2019, pp. 127–149.

Admissions Apply Now