Research Article
Nemesis: Detecting Algorithmically Generated Domains with an LSTM Language Model
@INPROCEEDINGS{10.1007/978-3-030-30146-0_24, author={Dunsheng Yuan and Ying Xiong and Tianning Zang and Ji Huang}, title={Nemesis: Detecting Algorithmically Generated Domains with an LSTM Language Model}, proceedings={Collaborative Computing: Networking, Applications and Worksharing. 15th EAI International Conference, CollaborateCom 2019, London, UK, August 19-22, 2019, Proceedings}, proceedings_a={COLLABORATECOM}, year={2019}, month={8}, keywords={Domain Generation Algorithm LSTM Language model Deep learning}, doi={10.1007/978-3-030-30146-0_24} }- Dunsheng Yuan
Ying Xiong
Tianning Zang
Ji Huang
Year: 2019
Nemesis: Detecting Algorithmically Generated Domains with an LSTM Language Model
COLLABORATECOM
Springer
DOI: 10.1007/978-3-030-30146-0_24
Abstract
Various malware families frequently apply Domain Generation Algorithms (DGAs) to generate numerous pseudorandom domain names to communicate with their Command and Control (C&C) servers. Security researchers make a lot of efforts to detect Algorithmically Generated Domains (AGDs) for fighting Botnets and relevant malicious network behaviors. In this paper, we propose a new AGD detection approach, Nemesis, based on a Long Short-Term Memory (LSTM) language model. Nemesis can identify whether given domain names are AGDs according to their string compositions, and without additional information. Nemesis first leverages an n-gram dictionary, which is built on real domain names, to tokenize domain names into n-grams. Then a pre-trained detector is used to classify domain names as real ones or AGDs according to the tokenized results. We evaluate Nemesis’ abilities to detect domain names generated by known DGAs and to discover new DGA families. It turns out that Nemesis can accurately detect AGDs with the precision of 98.6% and the recall of 96.7%. Besides, we verify that Nemesis largely outperforms several existing effective approaches.