On Detecting and Classifying DGA Botnets and their Families. Issue 113 (February 2022)

• Record Type: Journal Article
• Authors: Tuan, Tong Anh; Long, Hoang Viet; Taniar, David
• Is Part Of: Computers & security. Issue 113(2022)
• Publication Date: 2022-02
• Subjects: Botnet detection -- Dga botnets -- Deep learning -- Lstm network -- Attention Layer -- UMUDGA Dataset; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2021.102549
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: We approach botnet detection at the communication stage by detecting botnet DGAs. We solve two problems, including binary classification and multiclass classification. We proposed two deep learning models by combining LSTM and attention layer. LA_Bin07 and LA_Mul07 solve the DGA botnet problem with very high accuracy. Abstract: Botnets are a frequent threat to information systems on the Internet, capable of launching denial-of-service attacks, spreading spam and malware on a large scale. Detecting and preventing botnets is very important in cybersecurity. Previous studies have suggested anomaly-based, signature-based, or HoneyNet-based botnet detection solutions. This paper presents new solutions for detecting and classifying families of Domain Generation Algorithm (DGA) botnets. Our solution can be applied in practice to disable botnets even if they have infected the computer. Our works help solve two problems, including binary classification and multiclass classification, specifically: (1) Determining whether a domain name is malicious or benign; (2) For malicious domains, identify their DGA botnet family. We proposed two deep learning models called LA_Bin07 and LA_Mul07 by combining the LSTM network and Attention layer. Our evaluation used the UMUDGA dataset recently published in 2020, with 50 DGA botnet families. The experimental results show that the LA_Bin07 and LA_Mul07 models solve the DGA botnets problem for binary and multiclass classification problems with very high accuracy.