Automatic Detection of Malware-Generated Domains with Recurrent Neural Models

Modern malware families often rely on domain-generation algorithms(DGAs) to determine rendezvous points to their command-and-controlserver. Traditional defence strategies (such as blacklisting domains or IPaddresses) are inadequate against such techniques due to the large andcontinuously changing list of domains produced by these algorithms. Thispaper demonstrates that a machine learning approach based on recurrentneural networks is able to detect domain names generated by DGAs withhigh precision. The neural models are estimated on a large training set ofdomains generated by various malwares. Experimental results show that thisdata-driven approach can detect malware-generated domain names with a F1score of 0.971. To put it differently, the model can automatically detect 93 %of malware-generated domain names for a false positive rate of 1:100