AGCN-Domain: Detecting Malicious Domains with Graph Convolutional Network and Attention Mechanism

Xi Luo, Yixin Li, Hongyuan Cheng and Lihua Yin ()
Additional contact information
Xi Luo: Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China
Yixin Li: Big Data Center of State Grid Corporation of China, Xicheng District, Beijing 100052, China
Hongyuan Cheng: Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China
Lihua Yin: Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou 510006, China

Mathematics, 2024, vol. 12, issue 5, 1-16

Abstract: Domain Name System (DNS) plays an infrastructure role in providing the directory service for mapping domains to IPs on the Internet. Considering the foundation and openness of DNS, it is not surprising that adversaries register massive domains to enable multiple malicious activities, such as spam, command and control (C&C), malware distribution, click fraud, etc. Therefore, detecting malicious domains is a significant topic in security research. Although a substantial quantity of research has been conducted, previous work has failed to fuse multiple relationship features to uncover the deep underlying relationships between domains, thus largely limiting their level of performance. In this paper, we proposed AGCN-Domain to detect malicious domains by combining various relations. The core concept behind our work is to analyze relations between domains according to their behaviors in multiple perspectives and fuse them intelligently. The AGCN-Domain model utilizes three relationships (client relation, resolution relation, and cname relation) to construct three relationship feature graphs to extract features and intelligently fuse the features extracted from the graphs through an attention mechanism. After the relationship features are extracted from the domain names, they are put into the trained classifier to be processed. Through our experiments, we have demonstrated the performance of our proposed AGCN-Domain model. With 10% initialized labels in the dataset, our AGCN-Domain model achieved an accuracy of 94.27% and the F1 score of 87.93% , significantly outperforming other methods in the comparative experiments.

Keywords: malicious domain; graph convolutional network; attention mechanism; domain relations (search for similar items in EconPapers)
JEL-codes: C (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/2227-7390/12/5/640/pdf (application/pdf)
https://www.mdpi.com/2227-7390/12/5/640/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jmathe:v:12:y:2024:i:5:p:640-:d:1343494

Access Statistics for this article

Mathematics is currently edited by Ms. Emma He

More articles in Mathematics from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().