Word encoding for word-looking DGA-based Botnet classification

Abstract

There are two main types of domain name-generating algorithms (DGAs) – random-looking and word-looking. While existing methods can effectively distinguish between the two types of DGAs with high accuracy, classifying different types of word-looking DGAs has proven to be challenging, as they are often mistaken for legitimate domains. To address this issue, previous methods used character encoding with long short-term memory networks (LSTM) or convolutional neural networks (CNN) to model the character distribution of different word-looking DGAs. Since most word-looking DGAs are constructed using various dictionaries, we propose using word encoding instead of character encoding. Word encoding can provide a better characterization as it is based on the usage of different words in the dictionaries and their associations. Experimental results show that the classification accuracy for word-based DGAs increases by more than 7% (from 87% to 94%) using word encoding as compared to character encoding.