DomainGAN: Generating Adversarial Examples to Attack Domain Generation Algorithm Classifiers

  • 2019-11-14 18:12:36
  • Isaac Corley, Jonathan Lwowski, Justin Hoffman
  • 1

Abstract

Domain Generation Algorithms (DGAs) are frequently used to generate largenumbers of domains for use by botnets. These domains are often used asrendezvous points for the servers that malware has command and control over.There are many algorithms that are used to generate domains, but many of thesealgorithms are simplistic and are very easy to detect using classical machinelearning techniques. In this paper, three different variants of generativeadversarial networks (GANs) are used to improve domain generation by making thedomains more difficult for machine learning algorithms to detect. The domainsgenerated by traditional DGAs and the GAN based DGA are then compared by usingstate of the art machine learning based DGA classifiers. The results show thatthe GAN based DGAs gets detected by the DGA classifiers significantly less thanthe traditional DGAs. An analysis of the GAN variants is also performed to showwhich GAN variant produces the most usable domains. As verified by testingresults and analysis, the Wasserstein GAN with Gradient Penalty (WGANGP), isthe best GAN variant to use as a DGA.

 

Quick Read (beta)

loading the full paper ...