Toward Optimal LSTM Neural Networks for Detecting Algorithmically Generated Domain Names

Botnets pose a major threat to the information security of organizations and individuals. The bots (malware infected hosts) receive commands and updates from the Command and Control (C&C) servers, and hence, contacting and communicating with these servers is an essential requirement of bots. However, once a malware is identified in the infected host, it is easy to find its C&C server and block it, if the domain names of the servers are hard-coded in the malware. To counter such detection, many malwares families use probabilistic algorithms known as domain generation algorithms (DGAs) to generate domain names for the C&C servers. This makes it difficult to track down the C&C servers of the Botnet even after the malware is identified. In this paper, we propose a probabilistic approach for the identification of domain names which are likely to be generated by a malware using DGA. The proposed solution is based on the hypothesis that human generated domain names are usually inspired by the words from a particular language (say English), whereas DGA generated domain names should contain random sub-strings in it. Results show that the percentage of false negatives in the detection of DGA generated domain names using the proposed method is less than 29% across 30 DGA families considered by us in our experimentation.

In recent years, domain generation algorithms (DGAs) are the foundational mechanisms for many malware families. Mainly, due to the fact that DGA can generate immense number of pseudo random domain names to associate to a command and control (C2) infrastructures. This paper focuses on to detect and classify the pseudo random domain names without relying on the feature engineering or any other linguistic, contextual or semantics and statistical information by adopting deep learning approaches. A deep learning approach is a complex model of traditional machine learning mechanism that has received renewed interest by solving the long-standing tasks in artificial intelligence (AI) related to the field of natural language processing, image recognition, speech processing and many others. They have immense capability to extract optimal feature representations by taking input as in the form of raw input texts. To leverage this and to transfer the performance enhancement in aforementioned areas towards characterize, detect and classify the DGA generated domain names to a specific malware family, this paper adopts deep learning mechanisms with a known one million benign domain names from Alexa, OpenDNS and a corpus of malicious domain names generated from 17 DGA malware families in real time for training in character and bigram level and a trained model has been evaluated on the OSNIT data set in real-time. Specifically, to understand the effectiveness of various deep learning mechanisms, we used recurrent neural network (RNN), identity-recurrent neural network (I-RNN), long short-term memory (LSTM), convolution neural network (CNN), and convolutional neural network-long short-term memory (CNN-LSTM) architectures. Additionally, to find out an optimal architecture, experiments are done with various configurations of network parameters and network structures. All experiments run up to 1000 epochs with a learning rate set in the range [0.01-0.5]. Overall, deep learning approaches, particularly family of recurrent neural network and a hybrid network (where the first layer is CNN and a subsequent layer is LSTM) have showed significant performance with a highest detection rate 0.9945 and 0.9879 respectively. The main reason is deep learning approaches have inherent mechanisms to capture hierarchical feature extraction and long range-dependencies in sequence inputs.

Many modern botnet malwares use Domain Generation Algorithms (DGAs) to dynamically generate the domain names that resolve to their command and control (C2) centers. This approach allows these malwares to subvert traditional detection systems which rely on blacklists of known domains associated with malicious activities to block malware communications. Since the advent of DGA-based malwares, the efforts to prevent the said malwares from contacting their command and control centers (C2) server have been centered around detecting Algorithmically Generated Domain Names through lexicographic analysis, isolating entire infected devices or both. Recent research has emerged, which more accurately identifies infected devices in a network, by monitoring the volumes of domain resolution failures. While effective, these techniques are slow to identify DGA generated domain names. Even after the delayed identification, the only preliminary mitigation known today is a complete shutdown of a device that is suspected to be infected. In this paper, we present a new method to counter DGA-based malwares by limiting the impact of mitigation. Instead of isolating the entire infected device from the network we limit network activity of the malicious process alone. Our objective is to prevent DGA-based malwares from communicating with their C2 centers while allowing an infected device to maintain its normal functionality. We achieve this by tracking Domain Name Service (DNS) responses of individual processes and blacklisting those processes for which DNS traffic have abnormally large numbers of domain resolution failures. The blacklisting at a process level ensures that non-malicious processes in the infected device can continue functioning.

Domain generation algorithms (DGAs) are commonly leveraged by malware to create lists of domain names, which can be used for command and control (C&C) purposes. Approaches based on machine learning have recently been developed to automatically detect generated domain names in real-time. In this paper, we present a novel DGA called CharBot, which is capable of producing large numbers of unregistered domain names that are not detected by state-of-the-art classifiers for real-time detection of the DGAs, including the recently published methods FANCI (a random forest based on human-engineered features) and LSTM.MI (a deep learning approach). The CharBot is very simple, effective, and requires no knowledge of the targeted DGA classifiers. We show that retraining the classifiers on CharBot samples is not a viable defense strategy. We believe these findings show that DGA classifiers are inherently vulnerable to adversarial attacks if they rely only on the domain name string to make a decision. Designing a robust DGA classifier may, therefore, necessitate the use of additional information besides the domain name alone. To the best of our knowledge, the CharBot is the simplest and most efficient black-box adversarial attack against DGA classifiers proposed to date.

In today's cyber environment, modern botnets and malware are increasingly employing domain generation mechanisms to circumvent conventional detection solutions reliant on blacklisting or statistical methods for malicious domains. These outdated methods prove inadequate against algorithmically generated domain names, presenting significant challenges for cyber security. Domain Generation Algorithms (DGAs) have become essential tools for many malware families, allowing them to create numerous DGA domain names to establish communication with C&C servers. Consequently, detecting such malware has become a formidable task in cyber security. Traditional approaches to domain name detection rely heavily on manual feature engineering and statistical analysis, with classifiers designed to differentiate between legitimate and DGA domain names. In this study, we propose a novel approach to classify and detect algorithmically generated domain names. The deep learning architectures, including LSTM, RNN and GRU are trained and evaluated for their effectiveness in distinguishing between legitimate and malicious domain names. The performance of each model is evaluated using standard metrics such as precision, recall, and F1-score. The findings of this research have significant implications for cyber security defense strategies. Our experimental findings illustrate that the proposed model outperforms current state-of-the-art methods in both DGA domain name classification and detection. Our proposed model achieved 99% accuracy for DGA classification. By integrating additional feature extraction and knowledge-based methods our proposed model surpasses existing models. The experimental outcomes suggest that our proposed model gated recurrent unit can achieve 99% accuracy, a 94% recall rate, and a 98% F1-score for the detection and classification of DGA-generated domain names.

A botnet is a network of remote-controlled devices that are infected with malware controlled by botmasters in order to launch cyber attacks. To evade detection, the botmaster frequently changes the domain name of his Command and Control (C&C) server. Notice that most of these types of domain names are generated by domain generation algorithms (DGAs). In this paper, we propose Khaos, a novel DGA with high anti-detection ability based on neural language models and the Wasserstein Generative Adversarial Network (WGAN). The key insight of our research is that real domain names are composed of readable syllables and acronyms, and thus we can arrange syllables and acronyms using neural language models to mimic real domain names. In Khaos, we first find the most common n-grams in real domain names, then tokenize these domain names into n-grams, and finally synthesize new domain names after learning arrangements of n-grams from real domain names. We carry out experiments using a variety of state-of-the-art DGA detection approaches: the statistics-based, the distribution-based, the LSTM-based and the graph-based detection approach. Our experimental results show that the average distance for detecting Khaos under the distribution-based detection approach is 0.64, the AUCs of Khaos under the statistics-based and the LSTM-based detection approach are 0.76 and 0.57, respectively, and the precision of Khaos under the graph-based detection approach is 0.68. Our work proves that the existing detection approaches have big troubles in detecting Khaos, and Khaos has better anti-detection ability than state-of-the-art DGAs. In addition, we find that training the existing detection approach on a dataset including the domain names generated by Khaos can improve its detection ability.

In recent days, botnet plays an important role in malware distribution. This has been used as a primary approach for the proliferation of the malicious activities via the internet by attackers. To evade blacklisting, recent botnets make use of domain flux or internet protocol (IP) flux. This work focuses on domain flux. Domain flux uses domain generation algorithms (DGAs) to generate a list of domain names based on a seed and these domain names contacts command and control (C&C) server till it gets access permission to the system. This work presents the fully labeled domain name data set entitled as AmritaDGA which can be used for doing research in the field of detecting domain names which are generated using DGAs. We evaluate the efficacy of deep learning architectures with Keras embedding as domain name representation method on AmritaDGA. AmritaDGA is composed of two data sets. The first data set is collected from the publicly available sources. The second data set is collected from an internal real-time network. The performance of the trained model on public data set is evaluated on unseen samples of a public data set and private corpora. Deep learning architectures performed well in most of the cases of test experiments. The baseline system has been made publicly available and the data set is distributed for Detecting Malicious Domain names (DMD 2018) shared task.

Breast cancer is one of the most prevalent and chronic disease that affect women. To overcome this disease, effective medical treatment is required. Early detection of the disease plays an important role for suitable medication and survival of patient. To identify the breast cancer in the patients, standard imaging technique mammography is used. Due to the subtle and varied nature of cancer tissues interpreting mammogram images can be a challenge to doctors. Machine learning (ML) and Deep Learning (DL) techniques offer promising solutions that provide efficient breast cancer detection from mammograms. In this review paper a comprehensive review of ML and DL algorithms and their applications in mammogram image analysis are presented. Various supervised and unsupervised learning techniques, such as convolutional neural networks (CNNs), support vector machines (SVMs), random forests, and other popular ML and DL models are discussed in paper. The integration of these DL methods that are efficiently used in image preprocessing techniques, feature extraction, and classification strategies. The overall survey focusses on various performance metrics, datasets, and benchmarks used in existing studies. Further the strengths and limitations of different approaches used by various researchers are identified. By understating current research trends this paper aims to contribute to the ongoing development of more accurate and reliable breast cancer detection systems using advanced ML techniques.

Ransomwares spread rapidly over the past two years, which poses great security threats to users. DGA domain name detection is one of the key technologies in detecting ransomwares. Existing detection methods are usually based on machine learning, which needs large amounts of training data. However, it is difficult to collect enough training samples for a specific DGA family in a short time, and few training samples would lead to overfitting of the detection model. A LSTM DGA generation model can obtain a lot of new data learned from few real DGA samples. Reinforcement Learning guides this LSTM generation model to be improved by evaluating its generated domain name, which is proposed as RL-LSTM DGA generation model. In experiments, a DGA domain name detection model (ATT-GRU model) trained by the generated DGAs, is used to compute accuracies of real DGAs (as test dataset) to assess the validity of generated domain names. Experiments show that the distribution of generated DGAs is sufficiently close to real DGAs, and can play an alternative role of real DGAs in detection model training.

Domain Generation Algorithm (DGA) is an algorithm used by malware to generate a large number of domain names, or DGA domains, on a regular basis. This ancient but ever-active technique is the key weapon on which central structure botnets rely. In recent years, many botnets have adopted the DGA algorithm's domain transformation technique to evade detection and blocking, making it extremely difficult for security personnel to detect DGA domain names. In this article, we use the domain names of Alexa's top one million global websites as a white sample. For the DGA sample data, we take the open data of 360NetLab as the black sample to form the data set of this paper. We use 2-Gram model for feature extraction, and construct the DGA domain detection model based on the LightGBM algorithm. Experimental results show that the accuracy of our model is higher than 98%, and compared with the current common classification models, our model has better performance in both time and space.

Domain generation algorithms (DGAs) automatically generate large numbers of domain names in DNS domain fluxing for the purpose of command-and-control (C&C) communication. DGAs are immune to static prevention methods like blacklisting and sinkholing. Detection of DGAs in a live stream of queries in a DNS server is referred to as inline detection. Most of the previous approaches in the literature on DGA detection either: (i) are based on small synthetic data sets for training, rather than data collected from real traffic or (ii) require contextual information and therefore cannot be used for inline detection. In this work, we overcome these limitations by proposing a novel way to label a large volume of data collected from real traffic as DGA/non-DGA and by using deep learning techniques. Our classifiers can be trained with large amounts of real traffic, rather than small synthetic data sets, and therefore have better performance.

In order to stay undetected and keep their operations alive, cyber criminals are continuously evolving their methods to stay ahead of current best defense practices. Over the past decade, botnets have developed from using statically hardcoded IP addresses and domain names to randomly-generated ones, so-called domain generation algorithms (DGA). Malicious software coordinated via DGAs leaves however a distinctive signature in network traces of high entropy domain names, and a variety of algorithms have been introduced to detect certain aspects about currently used DGAs.

The EGNOS NOTAM proposals provision is a key enabler for the publication of RNP approaches down to LPV minima in Europe, as it provides the different AIS (Aeronautical Information Service) the required information to establish a NOTAM service covering this type of procedures, in line with the ICAO standards. Currently, more than 400 APV-I and 150 LPV-200 SBAS procedures are published in Austria, Belgium, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Lithuania, Luxembourg, Malta, Montenegro, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovak Republic, Spain, Sweden, Switzerland, UK and the Bailiwick of Guernsey. The EURONOTAM tool is responsible for generating EGNOS NOTAM proposals, implementing an analytical service volume that propagates the orbits of the satellites (based on the GPS almanacs) and computes the satellites in view for each configured airport. Once the satellite visibility is computed, the prediction module estimates the residual errors for each Line Of Sight (LoS), taking into account the number of EGNOS Ranging Integrity Monitoring Stations (RIMS) in view (for the User Differential Range Error —UDRE— computation) and the number of Ionospheric Pierce Points surrounding the neighbouring Ionospheric Grid Points (for the Grid Ionospheric Vertical Error —GIVE— estimation). With these estimations, the tool calculates the Protection Levels for each airport and determines if a new NOTAM proposal is to be issued in case the service is not available to support APV-I or LPV-200 operations in a specific location. Thus, the accuracy of the UDRE and GIVE estimations is essential in order to precisely predict the EGNOS availability events. Taking this into account, the present study is aimed at analysing the feasibility and the potential improvement that could be obtained, by using Machine Learning (ML) or Deep Learning (DL) techniques to enhance or replace the current analytical model. More specifically, the different “classic” ML models which will be addressed are decision trees, random forests, support vector machines and extreme gradient boosting (XGBoost). On top of these ML models, DL techniques are also covered by this study. The outputs of these models will be used to estimate the Protection Levels, and its applicability to the current EURONOTAM software will be discussed. The study will start with the analysis of the input dataset used to train the model. Aimed at analysing the impact of EGNOS station outages on the system performance and the capacity of the model to predict such impact, the input dataset will be composed of a minimum of 41 scenarios, including single and multiple station outages. For the UDRE estimation, more than 1.1 million samples, including the following features, will be considered: satellite coordinates, satellite dilution of precision (DOP) (based on the number of station in view), number of RIMS-A and RIMS-C on sight, satellite family, slot number and RIMS status. Similar features will be considered for the GIVE, with more than 3.5 million samples, including as well information on the number and distribution of the IPPs surrounding each IGP. Feature importance will be evaluated using SHAP values. SHAP values are calculated for each input feature and for each sample, and they measure the contribution of that feature to the predicted value for the sample. Summing the absolute SHAP values for all samples gives a measure of how the output is driven by that feature globally. This will be used to identify which are the most important features (and eventually, consider updating EURONOTAM model to consider these features – e.g. DOP) and discard the unimportant ones from the ML model. The real UDREi and GIVEi values used for the model training and testing will be obtained from the real EGNOS messages downloaded from the EDAS FTP. After preparing the input data set and splitting it into the training and testing datasets, the model hyperparameters will be tuned through a grid search with 5 fold cross-validation (for each set of values, 4/5 of the original training set will be used for actually training the model and the remaining 1/5 will be used for assessing the performance). The parameters resulting in the best averaged model performance will be selected. The resulting model will be evaluated with the testing dataset, using the following metrics: - Binary Accuracy: ratio between number of samples correctly classified as monitored or not-monitored vs the total number of samples - Total Accuracy: ratio between the number of correctly classified samples (considering the 16 possible labels) and the total number of samples. - Matthews correlation coefficient (MCC): A coefficient of +1 represents a perfect prediction and 0 represents an average random prediction. - Mean & RMS error on UDRE or GIVE value (UDREi / GIVEi converted to UDRE /GIVE for the assessment). The results obtained so far seem to indicate that Machine learning models can significantly improve the estimates obtained from the current analytical model (geometric-based). For instance, for one of the ML models tested, the system is able to correctly classify the 86% of the UDREi labels versus the 76% obtained with the current model, meaning a 13% improvement. In terms of binary accuracy, the ML model properly estimates the monitored / not-monitored status for the 99% of the samples tested. The RMS and mean absolute error are decreased by a 45% and 55% respectively. For the GIVE estimation, the improvement in the classification problem is more remarkable, with a 30% enhancement with respect to the current value. The RMS and mean absolute errors decrease as well by a 36% and a 50% factor respectively. The study will determine if Machine learning models can significantly improve the estimates obtained from the current analytical model (geometric-based). The study will also evaluate Protection Levels predicted with the usage of ML-estimated UDRE and GIVE values, where an important improvement in terms of prediction accuracy is expected. The analysis will be completed with a brief discussion on the available software libraries enabling the embedding of ML trained models in existing code and the capability of the model to predict situations that are very different from the ones actually trained. This is particularly challenging in this study, due to the lack of a full set of samples covering all the non-nominal conditions, since potential future situations might have never happened before and cannot be therefore, trained. Future steps will focus on this topic, and aim at finding more robust machine learning models that are able to deal with non-nominal conditions while still outperforming traditional methods under nominal conditions.

The article addresses the problem of detecting domains generated by Domain Generation Algorithms (DGA) which are widely used by attackers to build robust botnet control channels and covert communication. Traditional methods are based on manual feature engineering or specialized neural network architectures that reduce their robustness to evolving DGA families. The scientific novelty of the proposed approach lies in the use of Large Language Models (LLM) by leveraging their contextual adaptation mechanism to identify hidden patterns in domain names and classify them. The developed approach is based on the use of LLMs which receives examples of legitimate and generated domains within the context. To improve the efficiency, example selection strategies (TopK, VoteK), various metrics of data homogeneity and variability are used. Additionally, the influence of the domain name length and entropy on the stability of the approach is analyzed. The experimental part is performed on a dataset including 68 DGA families and a subset of legitimate Tranco domains. The training set included 54 families, and testing took place on all 68 families, including previously unseen 14 families. Results showed the efficiency of the approach: precision = 0.93, recall = 0.95 and F1-measure = 0.94. The ability of LLM to generalize rules to new DGA families is confirmed. Compared with existing methods, the proposed approach does not require additional retraining and provides flexibility due to contextual adaptation. It demonstrated resistance to noise and the capability to detect new DGA families, which makes its application promising in the field of cybersecurity. At the same time, the sensitivity of the model to the length of domain names and the need for context balancing were revealed. Promising areas of development are the integration of additional features (DNS metadata, query time series) and methods for adaptation to stream processing.

Domain Generation Algorithms (DGAs) continue to pose a significant threat in modern malware infrastructures by enabling resilient and evasive communication with Command and Control (C&C) servers. Traditional detection methods—rooted in statistical heuristics, feature engineering, and shallow machine learning—struggle to adapt to the increasing sophistication, linguistic mimicry, and adversarial variability of DGA variants. The emergence of Large Language Models (LLMs) marks a transformative shift in this landscape. Leveraging deep contextual understanding, semantic generalization, and few-shot learning capabilities, LLMs such as BERT, GPT, and T5 have shown promising results in detecting both character-based and dictionary-based DGAs, including previously unseen (zero-day) variants. This paper provides a comprehensive and critical review of LLM-driven DGA detection, introducing a structured taxonomy of LLM architectures, evaluating the linguistic and behavioral properties of benchmark datasets, and comparing recent detection frameworks across accuracy, latency, robustness, and multilingual performance. We also highlight key limitations, including challenges in adversarial resilience, model interpretability, deployment scalability, and privacy risks. To address these gaps, we present a forward-looking research roadmap encompassing adversarial training, model compression, cross-lingual benchmarking, and real-time integration with SIEM/SOAR platforms. This survey aims to serve as a foundational resource for advancing the development of scalable, explainable, and operationally viable LLM-based DGA detection systems.