Detecting DGA Using Deep Neural Networks (DNNs).

In recent days, malicious authors use domain generation algorithms so that they can easily evade blacklisting and heuristics mechanism. DGAs is used by a larger number of malware families to generate many pseudo-random domain names to connect to C2 server. In this paper, the deep neural network is employed along with 3-gram representation to transform the domain names into a numeric representation. Deep neural networks have a certain level of complexity since it uses sophisticated mathematical modeling to process data. The network parameters and network 3-gram representation is used to transform the domain names into a numeric representation. The network parameters and network structures for DNN are selected by following the hyperparameter selection method. All experiments are run until one hundred times with learning rate inside the range [0.01–0.5]. The experiments of DNN are run on DGA corpus given by DMD-2018 shared task organizer.