LSTM Neural Network for DGA Domain Name Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods fail to effectively identify domain names generated by Domain Generation Algorithms (DGAs) used by botnets, as they produce a large number of domain names quickly, making blacklist mechanisms inefficient and difficult to distinguish from benign names, especially with the use of legitimate DNS services.
Innovation Solution
A method utilizing a trained Long Short-Term Memory (LSTM) model to predict the probability that a domain name is generated by a DGA, which involves preprocessing and encoding domain names, using a neural network architecture including an embedded layer, LSTM layer, and fully-connected layer to extract features and determine the likelihood of DGA-generated domain names.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blacklist mechanisms are used to block DGA-generated domain names, then domain name filtering can be performed, but the mechanism becomes ineffective because DGA algorithms generate a large number of domain names quickly that are difficult to distinguish from benign names
Solution Approach 1:
The patent replaces the mechanical blacklist mechanism with a neural network-based predictive system. The LSTM model analyzes sequential patterns in domain name generation to predict future DGA-generated domain names, substituting reactive blocking with proactive prediction based on learned temporal patterns rather than simple keyword matching
Solution Approach 2:
The system implements feedback by continuously monitoring domain name resolution patterns and using this information to update and refine the LSTM model's predictions. The model learns from observed DGA behavior patterns and adjusts its predictions accordingly, creating a closed-loop system that improves over time
2Measurement precision
If DNS traffic is monitored and checked one by one to identify DGA-generated domain names, then detection accuracy can be improved, but the process becomes too slow and impractical due to the large volume of DNS traffic
Solution Approach 1:
The system performs preliminary action by training the LSTM model on historical DGA domain name patterns before actual detection occurs. The model pre-learns the sequential characteristics and generation patterns of DGA algorithms, so when new domain names appear, the system can quickly evaluate them against the learned patterns without requiring exhaustive analysis
Solution Approach 2:
The patent changes the parameter of domain name evaluation from exhaustive sequential checking to probabilistic prediction based on learned patterns. The LSTM model transforms the detection parameter from direct pattern matching to probability-based prediction, allowing rapid evaluation of domain names against learned DGA characteristics
3Measurement precision
If manual analysis methods are used to identify DGA-generated domain names based on subtle clues, then some DGA patterns can be detected, but the method becomes difficult to scale and cannot distinguish hidden features of advanced DGAs
Solution Approach 1:
The patent substitutes manual analysis with an automated neural network system. The LSTM model automatically learns and detects complex patterns in domain name generation sequences, replacing human analysts' ability to spot subtle clues with machine learning that can identify both obvious and hidden features of DGA algorithms
Solution Approach 2:
The system uses a composite approach by combining multiple layers of neural network processing (embedding layer, LSTM layer, fully connected layer) to analyze domain name patterns. This composite structure enables the system to detect both simple and complex DGA patterns through hierarchical feature extraction and pattern recognition
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure provides a method for evaluating domain name and a server using the same method. The method includes: retrieving a raw domain name and dividing the raw domain name into a plurality of parts; retrieving a specific part of the parts, wherein the specific part include characters; encoding the characters into encoded data; padding the encoded data to a specific length; projecting the encoded data being padded as embedded vectors; sequentially inputting the embedded vectors to a plurality cells of a long short term memory model to generate a result vector; and converting the result vector to a prediction probability via a fully-connected layer and a'.