DGA Malware Detection via Two-Stage Classifier
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious botnet communications using Domain Generation Algorithms (DGAs) face challenges in accuracy due to high variability in domain names and language usage, leading to many false positives and low recall, especially when relying solely on statistical features or combined approaches that are difficult to tune.
Innovation Solution
A two-stage machine learning approach is employed, where a classifier is first trained on labeled DGA and non-DGA domain names to achieve high recall, and then further trained on proxy logs to filter out false positives, using discriminative learning and additional features from URL decomposition and proxy log analysis to identify malicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If statistical features or combined approaches are used to detect DGA domains, then detection coverage is achieved, but false positives increase and recall decreases due to high variability in domain names and language usage
Solution Approach 1:
The detection process is divided into two distinct stages: a training stage using labeled domain names to learn DGA patterns, and a detection stage using proxy logs to identify malicious communications. This segmentation allows the system to specialize each stage for its specific task, improving overall accuracy while reducing false positives through progressive filtering
Solution Approach 2:
The system performs preliminary training on labeled domain names before actual detection begins. This preliminary action establishes a trained classifier that understands DGA patterns, enabling more accurate detection in subsequent operations and reducing false positives by pre-establishing detection criteria
2Ease of manufacture
If a classifier is trained only on domain names, then training is simple, but detection of actual malicious communications is insufficient
Solution Approach 1:
The system merges two types of training data: labeled domain names (providing DGA pattern knowledge) and proxy logs (providing communication behavior context). This combination in a two-stage training process creates a more robust classifier that detects both domain characteristics and communication patterns, significantly improving detection effectiveness
3Adaptability or versatility
If DGA variability and language diversity are increased, then domain generation capability improves, but detection accuracy deteriorates due to harder differentiation from legitimate domains
Solution Approach 1:
The system transitions from analyzing only domain name characteristics to incorporating proxy log dimensions that capture communication behaviors. This additional dimension provides new features for differentiation, enabling accurate classification of high-variability DGA domains by examining their communication patterns rather than relying solely on domain name analysis
Data Source
AI summary
Techniques are presented to identify malware communication with domain generation algorithm (DGA) generated domains. Sample domain names are obtained and labeled as DGA domains, non-DGA domains or suspicious domains. A classifier is trained in a first stage based on the sample domain names. Sample proxy logs including proxy logs of DGA domains and proxy logs of non-DGA domains are obtained to train the classifier in a second stage based on the plurality of sample domain names and the plurality of sample proxy logs. Live traffic proxy logs are obtained and the classifier is tested by classifying the live traffic proxy logs as DGA proxy logs, and the classifier is forwarded to a second computing device to identify network communication of a third computing device as malware network communication with DGA domains via a network interface unit of the third computing device based on the trained and tested classifier.