BotDetector: a system for identifying DGA-based botnet with CNN-LSTM

Xiaodong Zang (), Jianbo Cao (), Xinchang Zhang, Jian Gong and Guiqing Li
Additional contact information
Xiaodong Zang: Qufu Normal University
Jianbo Cao: Qufu Normal University
Xinchang Zhang: Shandong Provincial Key Laboratory of Computer Networks
Jian Gong: Southeast University
Guiqing Li: Qufu Normal University

Telecommunication Systems: Modelling, Analysis, Design and Management, 2024, vol. 85, issue 2, No 2, 207-223

Abstract: Abstract Botnets are one of the major threats to network security nowadays. To carry out malicious actions remotely, they heavily rely on Command and Control channels. DGA-based botnets use a domain generation algorithm to generate a significant number of domain names. By analyzing the linguistic distinctions between legitimate and DGA-based domain names, traditional machine learning schemes obtain great benefits. However, it is difficult to identify the ones based on wordlists or pseudo-random generated. Accordingly, this paper proposes an efficient CNN-LSTM-based detection model (BotDetector) that uses only a set of simple-to-compute, easy-to-compute character features. We evaluate our model with two open-source benchmark datasets (360 netlab, Bambenek) and real DNS traffic from the China Education and Research Network. Experimental results demonstrate that our algorithm improves by 1.6 $$\%$$ % in terms of accuracy and F1-score and reduces the computation time by 9.4 $$\%$$ % compared to other state-of-the-art alternatives. Remarkably, our work can identify botnet’s covert communication channels that use domain names based on word lists or pseudo-random generation without any help of reverse engineering.

Keywords: Network security; Deep learning; Domain generation algorithm; CNN; LSTM; Botnet; DNS traffic (search for similar items in EconPapers)
Date: 2024
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
http://link.springer.com/10.1007/s11235-023-01073-7 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:telsys:v:85:y:2024:i:2:d:10.1007_s11235-023-01073-7

Ordering information: This journal article can be ordered from
http://www.springer.com/journal/11235

DOI: 10.1007/s11235-023-01073-7

Access Statistics for this article

Telecommunication Systems: Modelling, Analysis, Design and Management is currently edited by Muhammad Khan

More articles in Telecommunication Systems: Modelling, Analysis, Design and Management from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().