Detecting Domain Generation Algorithms Based on Cascade Foresets

Abstract

In a botnet, the attacker often uses domain fluxing to hide communication channel. Domain Generation Algorithm (DGA) is a kind of technique which is usually utilized by domain fluxing. Each bot uses a DGA to generate plenty of domain names and one of them will be registered by the botmaster as the domain name mapping to the C&C server. The security personnel will be in trouble with a large number of DGA domain names. In this paper, we propose a DGA detection approach called Minos. This approach detects DGA-generated domain names by analyzing the word-formation of domain names with the cascaded forest algorithm. The key insight of Minos is that domain names are made up of syllables or acronyms for easy reading, and n-grams can generally represent both of them. Our experimental results show that Minos can accurately identify domain names generated by DGAs with a precision of 93.8% and a recall rate of 93.5%.