{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/predicting-domain-generation-algorithms-with","title":"Predicting Domain Generation Algorithms with Long Short-Term Memory Networks","arxiv_id":"1611.00791","date":"2016-11-02","proceeding":null,"authors":["Jonathan Woodbridge","Hyrum S. Anderson","Anjum Ahuja","Daniel Grant"],"abstract":"Various families of malware use domain generation algorithms (DGAs) to\ngenerate a large number of pseudo-random domain names to connect to a command\nand control (C&C) server. In order to block DGA C&C traffic, security\norganizations must first discover the algorithm by reverse engineering malware\nsamples, then generating a list of domains for a given seed. The domains are\nthen either preregistered or published in a DNS blacklist. This process is not\nonly tedious, but can be readily circumvented by malware authors using a large\nnumber of seeds in algorithms with multivariate recurrence properties (e.g.,\nbanjori) or by using a dynamic list of seeds (e.g., bedep). Another technique\nto stop malware from using DGAs is to intercept DNS queries on a network and\npredict whether domains are DGA generated. Such a technique will alert network\nadministrators to the presence of malware on their networks. In addition, if\nthe predictor can also accurately predict the family of DGAs, then network\nadministrators can also be alerted to the type of malware that is on their\nnetworks. This paper presents a DGA classifier that leverages long short-term\nmemory (LSTM) networks to predict DGAs and their respective families without\nthe need for a priori feature extraction. Results are significantly better than\nstate-of-the-art techniques, providing 0.9993 area under the receiver operating\ncharacteristic curve for binary classification and a micro-averaged F1 score of\n0.9906. In other terms, the LSTM technique can provide a 90% detection rate\nwith a 1:10000 false positive (FP) rate---a twenty times FP improvement over\ncomparable methods. Experiments in this paper are run on open datasets and code\nsnippets are provided to reproduce the results.","url_abs":"http://arxiv.org/abs/1611.00791v1","url_pdf":"http://arxiv.org/pdf/1611.00791v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"predicting-domain-generation-algorithms-with","repo_url":"https://github.com/endgameinc/dga_predict","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":null},{"paper_slug":"predicting-domain-generation-algorithms-with","repo_url":"https://github.com/harpomaxx/deepseq","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null},{"paper_slug":"predicting-domain-generation-algorithms-with","repo_url":"https://github.com/sndp89/Malware-Detection-GPU","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null}],"tasks":[{"task_slug":"binary-classification","task_name":"Binary Classification"}],"methods":[{"method_slug":"lstm","method_name":"LSTM"},{"method_slug":"sigmoid-activation","method_name":"Sigmoid Activation"},{"method_slug":"tanh-activation","method_name":"Tanh Activation"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}