🤖 AI Summary
To address the limitation of static blacklists in detecting DGA-generated malicious domains, this paper proposes a novel detection method integrating NLP-based lexical features with LSTM deep learning. Unlike conventional entropy-based shallow analysis, our approach is the first to incorporate character-level n-grams and lexical diversity—linguistic features—into an LSTM sequence modeling framework, enabling joint semantic and structural discrimination of dynamically generated domains. Evaluated on a hybrid dataset of 100,000 domains, the model achieves 97.2% accuracy, substantially outperforming entropy-based baselines. It demonstrates particular strength in identifying sophisticated DGA families (e.g., Botnet, Crypto) and reduces false positives on benign domains to just 1.3%, effectively balancing high detection recall with low false alarm rates.
📝 Abstract
The sophistication of modern malware, specifically regarding communication with Command and Control (C2) servers, has rendered static blacklist-based defenses obsolete. The use of Domain Generation Algorithms (DGA) allows attackers to generate thousands of dynamic addresses daily, hindering blocking by traditional firewalls. This paper aims to propose and evaluate a method for detecting DGA domains using Deep Learning and Natural Language Processing (NLP) techniques. The methodology consisted of collecting a hybrid database containing 50,000 legitimate and 50,000 malicious domains, followed by the extraction of lexical features and the training of a Recurrent Neural Network (LSTM). Results demonstrated that while statistical entropy analysis is effective for simple DGAs, the Neural Network approach presents superiority in detecting complex patterns, reaching 97.2% accuracy and reducing the false positive rate in ambiguous lawful traffic scenarios.