Open Peer Review. Open Publishing. Open Access. Open Discussion. Open Directory. Open Recommendations. Open API. Open Source.
Character Level Based Detection of DGA Domain Names
Bin Yu, Jie Pan, Jiaming Hu, Anderson Nascimento, Martine De Cock
Feb 15, 2018 (modified: Feb 15, 2018)ICLR 2018 Conference Blind Submissionreaders: everyoneShow Bibtex
Abstract:Recently several different deep learning architectures have been proposed that take a string of characters as the raw input signal and automatically derive features for text classification. Little studies are available that compare the effectiveness of these approaches for character based text classification with each other. In this paper we perform such an empirical comparison for the important cybersecurity problem of DGA detection: classifying domain names as either benign vs. produced by malware (i.e., by a Domain Generation Algorithm). Training and evaluating on a dataset with 2M domain names shows that there is surprisingly little difference between various convolutional neural network (CNN) and recurrent neural network (RNN) based architectures in terms of accuracy, prompting a preference for the simpler architectures, since they are faster to train and less prone to overfitting.
TL;DR:A comparison of five deep neural network architectures for detection of malicious domain names shows surprisingly little difference.
Keywords:deep neural networks, short text classification, cybersecurity, domain generation algorithms, malicious domain names
Enter your feedback below and we'll get back to you as soon as possible.