PROJECT TITLE :

A Machine Learning Framework for Domain Generation Algorithm (DGA)-Based Malware Detection

ABSTRACT:

To alter communication, attackers typically employ a command and control (C2) server. Threat actors frequently use a domain generation algorithm (DGA) to carry out an attack, which allows malware to communicate with C2 by producing a variety of network locations. Blacklisting and other traditional malware control approaches are ineffective against DGA attacks. To mitigate the threat, we present a machine learning system for recognizing and identifying DGA domains in this research. Over the course of a year, we collect real-time threat data from real-life traffic. A deep learning approach is also proposed to classify a large number of DGA domains. A two-level model and a prediction model are included in the proposed machine learning framework. We first characterize DGA domains as distinct from normal domains in the two-level model, and then utilize the clustering method to discover the algorithms that generate those DGA domains. Based on the hidden Markov model, a time-series model is built to forecast incoming domain features in the prediction model (HMM). We also built a deep neural network (DNN) model to improve the proposed machine learning framework by handling the massive dataset we accumulated over time. The correctness of the suggested framework and the DNN model is demonstrated by our comprehensive experimental data. To be more specific, the framework achieves a classification accuracy of 95.89 percent and a DNN model accuracy of 97.79 percent, second-level clustering accuracy of 92.45 percent, and HMM prediction accuracy of 95.21 percent.