[Paper Review] Automatic Detection of Malware-Generated Domains with Recurrent Neural Models

Pierre Lison, Vasileios Mavroeidis|arXiv (Cornell University)|Sep 20, 2017

Advanced Malware Detection Techniques16 references59 citations

TL;DR

The paper trains recurrent neural networks to detect DGA-generated domain names from pure domain strings, achieving high F1 scores and strong recall at very low false-positive rates.

ABSTRACT

Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F_1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.

Motivation & Objective

• Motivate the need to detect domain-generation algorithm (DGA) domains to defeat C2 rendezvous in modern malware families.
• Develop a data-driven, feature-free detection method that relies solely on domain names.
• Evaluate recurrent neural network architectures on a large, multi-source DGA/domain dataset.
• Demonstrate performance advantages over lexical bigram baselines and analyze design choices for deployment.

Proposed method

• Use recurrent neural networks (GRU/LSTM) processing character sequences of domain names.
• Represent characters as one-hot vectors (and compare with embeddings).
• Train to output the probability that a domain is DGA-generated using supervised learning.
• Evaluate architecture variants (bidirectionality, dense output layer, multi-task learning) and select a configuration offering best performance with efficiency.
• Compare against a bigram-based logistic regression baseline and report multiple metrics (precision, recall, F1, ROC AUC).

Experimental results

Research questions

• RQ1 Can RNN-based models detect malware-generated domains using only domain names without external context?
• RQ2 How do architectural choices (embeddings, bidirectionality, output layers) impact detection performance and efficiency?
• RQ3 Is a multi-task setup (detection plus classification of malware family) advantageous relative to separate models?
• RQ4 What is the performance of the proposed method on a large, multi-source dataset spanning many malware families?

Key findings

• The neural model achieves an F1 score of 0.971 on malware-generated domain detection, outperforming the bigram baseline.
• At a false positive rate of 1:100, the neural model detects 93% of malware-generated domains; at 1:1000 FPR, the recall is 68%; at 1:10 FPR, recall reaches 99.9%.
• Using one-hot input with 512-dimensional GRU units provides strong performance; embeddings and bidirectional variants offered limited or no clear gains.
• The neural model also enables high-throughput processing (tens of thousands of domains per second on a single GPU).
• Dictionary-based DGAs (e.g., suppobox) are learnable by the model given sufficient training data, while some families like matsnu remain challenging with limited examples.