Detecting DGA domains with recurrent neural networks and side
  information
  Modern malware typically makes use of a domain generation algorithm (DGA) to
avoid command and control domains or IPs being seized or sinkholed. This means
that an infected system may attempt to access many domains in an attempt to
contact the command and control server. Therefore, the automatic detection of
DGA domains is an important task, both for the sake of blocking malicious
domains and identifying compromised hosts. However, many DGAs use English
wordlists to generate plausibly clean-looking domain names; this makes
automatic detection difficult. In this work, we devise a notion of difficulty
for DGA families called the smashword score; this measures how much a DGA
family looks like English words. We find that this measure accurately reflects
how much a DGA family's domains look like they are made from natural English
words. We then describe our new modeling approach, which is a combination of a
novel recurrent neural network architecture with domain registration side
information. Our experiments show the model is capable of effectively
identifying domains generated by difficult DGA families. Our experiments also
show that our model outperforms existing approaches, and is able to reliably
detect difficult DGA families such as matsnu, suppobox, rovnix, and others. The
model's performance compared to the state of the art is best for DGA families
that resemble English words. We believe that this model could either be used in
a standalone DGA domain detector---such as an endpoint security
application---or alternately the model could be used as a part of a larger
malware detection system.
