Artificial Neural Network Based DGA Botnet Detection

Abstract

In the recent years, botnet has become a serious threat to network security. As the result, the botnet detection solution is becoming an important topic for network security. DNS request is usually the first step to contact the C&C server of the bots controlled by the bot master and the detection of the DNS request domains is an effective way in detecting the bots. However, most botnets based on DNS protocol adopt Domain Generation Algorithm (DGA), which can change the domain randomly to hide themselves. Therefore, the traditional signature-based approach is rendered ineffective. Compared with the conventional ways of detection, the detection based on machine learning can obtain better detection result. In this work, we propose a botnet detection architecture based on Artificial Neural Network. We implement and evaluate the practicability of this solution with real datasets.