{'fraction_non_alphanumeric': 0.01870503597122302, 'fraction_numerical': 0.0, 'mean_word_length': 5.3807339449541285, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Identifying DGA Malware via Behavior Analysis

The behavior of the domain name is actually demonstrated by the behavior of the IP address. By observing the traffic behavior of their resolved IPs, the maliciousness of the domain names can be further divided. Deep packets inspection, reverse engineering and other approaches based on clustering technique in detecting malware using domain generation algorithms(DGA) are inefficient and with lots of false positives in large-scale networks. To address these challenges, this paper introduces a novel idea to identify DGA-based malware via behavior analysis. More specifically, four different types of traffic behaviors are focused, such as the rhythmic behavior, the cyclical behavior, the access stable behavior and the service diversity behavior. These behaviors are characterized, modeled and evaluated by using the metrics of the number of flows in each period of time, the access interval, the number of corresponding communication IPs in each period of time and the number of application types. NetFlow data of the resolved IP corresponding to the domain names collected from China Education Research Network backbone (CERNET) is applied to verify our proposal. Experimental results demonstrate that the application of IP address traffic behavior analysis can detect C& C channels of DGA-based malware regardless of its payload content.