Abstract
Domain Generation Algorithms (DGAs) are often used to generate huge amounts of domain names to maintain command and control (C2) between the infected computer and the master bot. Blacklist approaches become ineffective way to detect DGA as the number of domain names to block are large and vary over time. Since DGAs are unexpectedly distributed, conventional approaches have trouble detecting DGAs. Several deep learning architectures that accept a series of characters as a raw input signal and automatically classify them have recently been suggested. This paper compares three neural network algorithms in cyber security systems to detect domain generation algorithm, in particular, long-short-term memory (LSTM), convolution neural network (CNN) and bidirectional long-short-term memory (biLSTM). We examine in detail these three neural network algorithms for detecting DGAs based on mixed classes of DGA data containing more than 30 classes of DGAs, and we discuss the drawbacks and strengths of each method.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Woodbridge, J., Anderson, H.S., Ahuja, A., Grant, D.: Predicting domain generation algorithms with long short-term memory networks (2016). https://arxiv.org/abs/1611.00791
Saxe, J., Berlin, K.: eXpose: a character-level convolutional neural network with embeddings for detecting malicious URLs, file paths and registry keys (2017). https://doi.org/10.48550/arXiv.1702.08568
Yu, B., Gray, D.L., Pan, J., De Cock, M., Nascimento, A.C.: Inline DGA detection with deep networks. In: 2017 IEEE International Conference on Data Mining Workshops (ICDMW), pp. 683–692. IEEE, November 2017
Thakur, K., Alqahtani, H., Kumar, G.: An intelligent algorithmically generated domain detection system. Comput. Electr. Eng. 92, 107129 (2021)
Highnam, K., Puzio, D., Luo, S., Jennings, N.R.: Real-time detection of dictionary DGA network traffic using deep learning. SN Comput. Sci. 2(2), 1–17 (2021)
Dhingra, B., Zhou, Z., Fitzpatrick, D., Muehl, M., Cohen, W.W.: Tweet2vec: character-based distributed representations for social media. In: Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics, vol. 2, pp. 269–274 (2016)
Vosoughi, S., Vijayaraghavan, P., Roy, D.: Tweet2vec: learning tweet embeddings using character-level CNN-LSTM encoder-decoder. In Proceedings of the 39th International ACM SIGIR Conference on Research and Development in Information Retrieval, pp. 1041–1044, July 2016
Lavanya, P.M., Sasikala, E.: Deep learning techniques on text classification using Natural language processing (NLP) in social healthcare network: a comprehensive survey. In: 2021 3rd International Conference on Signal Processing and Communication (ICPSC), pp. 603–609. IEEE, May 2021
Zhang, X., Zhao, J., LeCun, Y.: Character-level convolutional networks for text classification. In: Advances in Neural Information Processing Systems, vol. 28, pp. 649–657 (2015)
Kowsari, K., Jafari Meimandi, K., Heidarysafa, M., Mendu, S., Barnes, L., Brown, D.: Text classification algorithms: a survey. Information 10(4), 150 (2019)
Akhter, M.P., Jiangbin, Z., Naqvi, I.R., Abdelmajeed, M., Fayyaz, M.: Exploring deep learning approaches for Urdu text classification in product manufacturing. Enterp. Inf. Syst. 16(2), 223–248 (2022)
Aviv, A.J., Haeberlen, A.: Challenges in experimenting with botnet detection systems. In: 4th Workshop on Cyber Security Experimentation and Test (CSET 2011), p. 6 (2011)
Hochreiter, S., Schmidhuber, J.: Long short-term memory. Neural Comput. 9(8), 1735–1780 (1997)
McKinney, P.: A foundational Python library for data analysis and statistics, Python high perform. Sci. Comput. (14), 1–9 (2011)
Gulli, A., Pal, S.:Deep Learning with Keras. Packt Publishing Ltd., Birmingham (2017)
Varoquaux, G., Buitinck, L., Louppe, G., Grisel, O., Pedregosa, F., Mueller, A.: Scikit-learn: machine learning without learning the machinery. GetMobile: Mob. Comput. Commun. 19(1), 29–33 (2015)
Drabas, T., Lee, D.: Learning PySpark. Packt Publishing Ltd., Birmingham (2017)
Meng, X., et al.: Mllib: machine learning in apache spark. J. Mach. Learn. Res. 17(1), 1235–1241 (2016)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Hassaoui, M., Hanini, M., El Kafhali, S. (2023). A Comparative Study of Neural Networks Algorithms in Cyber-Security to Detect Domain Generation Algorithms Based on Mixed Classes of Data. In: Kacprzyk, J., Ezziyyani, M., Balas, V.E. (eds) International Conference on Advanced Intelligent Systems for Sustainable Development. AI2SD 2022. Lecture Notes in Networks and Systems, vol 712. Springer, Cham. https://doi.org/10.1007/978-3-031-35251-5_23
Download citation
DOI: https://doi.org/10.1007/978-3-031-35251-5_23
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-35250-8
Online ISBN: 978-3-031-35251-5
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)