Applying Deep Learning to Identify and Classify DGA Domains

Abstract

The purpose of this work is to study methods for detecting malicious domains generated using DGA algorithms. To solve this problem, proposed to create a deep learning architecture based on the Tensorflow framework, and implement layers based on the Keras library. For training, testing and validation of the resulting architecture, data generated based on 25 known DGA generation algorithms and legitimate data obtained from Top Alexa were used. Using the data obtained, the proposed neural network architecture was compared with the known implementations of machine learning architectures according to the classification of DGA domains. The target metric by which the quality of the classification was compared was the f-measure with the parameter - the weight of accuracy in the metric (β) equal to 0.4, which made it possible to choose the model with the highest prediction accuracy. The results obtained confirmed the effectiveness of the proposed solution. The result of the work was the creation of an effective machine learning architecture used to classify malicious DGA domains.