{'fraction_non_alphanumeric': 0.028067008607215973, 'fraction_numerical': 0.01400048429348185, 'mean_word_length': 4.87608330099599, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
MaskDGA: A Black-box Evasion Technique Against DGA Classifiers and Adversarial Defenses

Domain generation algorithms (DGAs) are commonly used by botnets to generate domain names through which bots can establish a resilient communication channel with their command and control servers. Recent publications presented deep learning, character-level classifiers that are able to detect algorithmically generated domain (AGD) names with high accuracy, and correspondingly, significantly reduce the effectiveness of DGAs for botnet communication. In this paper we present MaskDGA, a practical adversarial learning technique that adds perturbation to the character-level representation of algorithmically generated domain names in order to evade DGA classifiers, without the attacker having any knowledge about the DGA classifier's architecture and parameters. MaskDGA was evaluated using the DMD-2018 dataset of AGD names and four recently published DGA classifiers, in which the average F1-score of the classifiers degrades from 0.977 to 0.495 when applying the evasion technique. An additional evaluation was conducted using the same classifiers but with adversarial defenses implemented: adversarial re-training and distillation. The results of this evaluation show that MaskDGA can be used for improving the robustness of the character-level DGA classifiers against adversarial attacks, but that ideally DGA classifiers should incorporate additional features alongside character-level features that are demonstrated in this study to be vulnerable to adversarial attacks.


INTRODUCTION
Botnets are groups of inter-connected devices that are designed to carry large-scale cyber-attacks [51] such as distributed denial-ofservice [2], data-theft [28], and spam [34]. The design of modern botnets often involve advanced techniques that challenge the ability to detect the botnet operation and take it down. Domain generation algorithms (DGAs) [36], a notorious technique, has been used by more than 40 documented botnets in the last decade.
Domain generation algorithms are used to generate a large number of pseudo-random domain names, which are usually based on the date and a secret input (seed). A bot and its command and control server that wish to communicate will both execute the DGA with a shared seed in order to generate a sequence of domain names and identify the one through which their communication can take place. DGAs can be used to generate thousands of domain names per day which must be identified and analyzed in order to shutdown of the botnet.
The detection of algorithmically generated domain (AGD) names initially focused on capturing binary samples of bots, extracting their algorithms and seeds, and generating the domain names in advance for mitigation [35,37,43]. However, by using new input seeds, this approach can be easily evaded by botnets. In fact, between the years of 2017 and 2018 at least 150 new seeds were introduced by botnets, 1 a figure which is more than two times the number of documented DGAs. Using machine learning in order to inspect the lexicographic patterns of domain names for detecting AGD names and classify their generating algorithms [46,52] is an alternative and more generalized approach.
Machine learning-based DGA detection techniques have become extremely successful, with state of the art algorithms achieving high detection rates on multiple datasets [42] with inline latency [23]. These techniques reduce the effectiveness of DGAs for maintaining resilient and stealthy botnet communication. From the botnet operator's perspective, a solution that can evade these state of the art detection mechanisms by using adversarial machine learning to produce AGD names that are less likely to be detected can be beneficial.
Adversarial machine learning is a technique in the field of machine learning which attempts to "fool" models (during either the training or execution phases) through adversarial input [25], also referred to as adversarial samples.
In the context of DGA classification, generative adversarial networks (GANs) [18] were previously suggested by Anderson et al. [3] in a method called DeepDGA, in order to to generate adversarial samples of "fake" domain names that are indistinguishable from real benign domain names that were available in the training set. The fake domain names generated are used to augment the training set with additional benign domain names and accordingly improve the model's robustness. Because DeepDGA was trained to generate domain names that resemble benign domains, the fake domain names generated are mostly short and readable. This makes the generated domain names impractical for botnets, since they are more likely to be used by legitimate users (e.g., the domain name "laner.com" generated by DeepDGA was already owned by Laner Electric Supply). In addition, short domain names are usually more expensive and thus increase the attacker's costs for maintaining the botnet communication.
In this paper we explore the ability to evade detection by DGA classifiers. We present MaskDGA, a black-box adversarial learning technique that adds perturbations to a character level representation of an AGD and transforms it to a new domain name that is falsely classified as benign by DGA classifiers, without prior knowledge of the classifier's architecture and parameters. MaskDGA can be applied as an extension to an existing malware to evade detection on the network perimeter by security solutions (as depicted in Figure 1).
MaskDGA utilizes the transferability property [30] and is conducted by first training a substitute model on datasets of publicly known AGD names. The attacker then generates a set of AGD names to which MaskDGA is applied. The domain names generated are provided as input to the substitute model and applied in a single feed forward step. The results of the feed forward step are used to compute the loss with regards to the benign class. MaskDGA then performs a single back-propagation step in which the loss propagates the gradients back to the input to form a Jacobian saliencey map [32] (JSM). Finally, for every domain name generated, MaskDGA replaces exactly half of the characters that had the largest gradient values in the JSM, so that the resulting domain name remains long and likely unreadable. Changing only half of the characters for a set of randomly generated AGD names also implies that we can expect a small number of collisions among the domain names in the output set, and therefore, the number of domains in the output set will remain close to that of the original set (created by the DGA). Eventually, the effort required for detecting and taking down the botnet remains the same.
MaskDGA was designed based on the Jacobian-based saliency map adversarial attack [32] (JSMA) that was originally applied to images. In contrast to the JSMA attack, MaskDGA is restricted to (1) producing valid character-level changes, (2) performing a constant number of changes, and (3) changing the same feature (character) only once, thus making it more suitable for character-level DGA classification evasion.
The evaluation of MaskDGA was performed using the recently published DMD-2018 dataset of AGD names and open-source DGA classifiers [12]. We also applied DeepDGA [3] as a technique for evading the detection models, and compared its performance with that of MaskDGA. The results show that when applying MaskDGA, the detection rate degrades from an average F1-score of 0.977 to 0.495, while the DeepDGA attack results in an average F1-score of 0.780.
We also evaluated MaskDGA against the same DGA classifiers enhanced with adversarial learning defenses, namely adversarial re-training (using domains generated by DeepDGA [4] and by MaskDGA) and distillation [33], and assessed their effectiveness. The results shows that adversarial re-training can be effective to some extent against the evasion techniques but still leads to the conclusion that a more resilient detection mechanism is required.
In summary, the contributions of this paper are as follows: • we present a practical evasion technique for DGA detection machine learning models; • the evasion technique can be applied as a wrapper on the existing DGA source code used by the botnet and therefore easy to apply; • the technique is generic and can be applied to any DGA family and input seed, while adhering to the expected requirements of a DGA, i.e., uniqueness, validity and rareness of domain names; • we present an evaluation of the presented evasion technique using four recently published DGA classifiers, and we assess the robustness of MaskDGA against commonly used adversarial defense techniques; • from the presented evasion technique we conclude that the detection of DGA mechanisms should not rely solely on character-level DGA features and ideally DGA classifiers should incorporate additional behavioral features.

BACKGROUND 2.1 Character-level DGA classification
A character-level representation of a word W over the alphabet of symbols V is a binary matrix X |W | · |V | s.t.
i.e., X i, j is set to one if the i-th character of the word W matches the j-th symbol in the alphabet V and zero if otherwise.
Recently published models for DGA classification [40,52] are based on character-level representations of domain names due to their high accuracy [6] and inline latency [23], provided that no additional context is required (e.g., network traffic features). Therefore, the focus of the evasion techniques presented in this study is on character-level DGA classification.

Adversarial learning
Adversarial learning attacks can be divided into poisoning attacks performed during training [7,9], and evasion attacks performed during testing [8,19,31]. Evasion attacks usually involve adding perturbation (noise) to the input sample's features to result in a misclassification by the attacked model. Such inputs are also referred to as adversarial samples. In order to make the targeted model classify the sample X whose true label is Y as Y * , the attacker would have to find a perturbation δ X such that (X + δ X ) is classified as Y * . If the attack is aimed at a specific class in the data, it is referred to as a targeted attack [30].
Attacks also vary based on the knowledge the adversary has about the classifier. A black-box evasion attack requires no knowledge about the model beyond the ability to query it as a black-box, i.e., inserting an input and getting the output classification. In a white-box attack, the adversary can have varying degrees of knowledge about the model architecture, hyper parameters and data used for training.
Most black-box attacks rely on the concept of adversarial example transferability, also known as the transferability property [30]. According to the transferability property, adversarial examples crafted against one model are also likely to be effective against other models, even when the models are trained on different datasets (but assumed to be sampled from the same distribution) [32,45]. This means that the adversary can train a substitute model, which has decision boundaries similar to the original model, and perform a white-box attack on it, i.e., obtain the back-propagated gradients in order to add perturbation that would result in the desired target misclassification. Adversarial examples that successfully fool the substitute model are likely to fool the original model as well [31]. After training a substitute model (a), and generating a set of AGD names using an existing DGA (b), the attacker applies MaskDGA as a wrapper to add perturbation to the set of AGD names, which will result in a new set of adversarial domain names that evade detection (c). The bot operator can register the adversarial AGD names (1) to allow its bots to establish a communication channel with their command and control server via the adversarial domain names (2-4) while evading detection on the security perimeter.
In this paper we present a black-box technique aiming at evading DGA detection models.

THREAT MODEL
Training capability (black-box). We assume that the targeted DGA detection models are not available to the botnet operator, and therefore the attacker cannot rely on knowledge about the architecture of the targeted model. However, we assume that the botnet operator can use publicly available AGD datasets and previously published architectures in order to train a substitute model.
Targeted misclassification for the benign class. The targeted models are multiclass DGA classification models whose input is a domain name and output is a probability distribution for the set of DGA classes and the benign class (e.g., [40,52]). The class with the maximal value in the output probability distribution is selected by the DGA classifier as the predicted class. A misclassification between the various DGA labels would still result in the detection of the malicious domain name and is therefore considered an unsuccessful adversarial attack. Thus, the attacker's goal is a targeted misclassification of the adversarial input as the benign class.

THE EVASION TECHNIQUE 4.1 Overview
The evasion technique is performed according to the following main steps (portrayed in Figure 2): • Training a substitute model. The attacker acquires a dataset of public samples of AGD names and uses it to train a discrminative model that distinguishes AGD names from benign domain name. The model is referred to as the substitute model. • Generating the algorithmically generated domain names.
The attacker executes an existing DGA with a randomly selected seed and generates a set of AGD names. • Constructing a Jacobian-based saliency map. For every generated AGD, the attacker performs a single feed forward step in the substitute model. The results of the feed forward step are used to compute the loss with regard to the benign class. The attacker performs a single back-propagation step on the loss in order to acquire the Jacobian-based saliency map, which is a matrix that assigns every feature in the input AGD with a gradient value. Features (characters) with higher gradient values in the JSM would have a more significant (salient) effect on the misclassification of the input AGD name and hence the name saliency map. • Adding perturbation to the input AGD name based on the JSM. For every input AGD name, iterate over every character position from the first character to the last. For every position, save the highest salient symbol and its value, e.g., in the first position the symbol "a" may have the highest value in the JSM. Set the top half of the character positions with regard to the maximal saliency values to the symbols that yielded the maximal saliency values (as portrayed in Algorithm 1).

Training a substitute model
The substitute model is a discrminative model (i.e., classifier) that distinguishes algorithmically generated domain names from benign domain names. The input layer of the model accepts character-level domain name features in the feed forward step and then reads the gradient for every feature in the back-propagation step for the construction of the JSM. The output layer of the model can be either binary (e.g., DGA or benign) or multiclass to predict the specific DGA.
Formally, the substitute model learns a function F that accepts an input domain name X with a predicted class Y . These notations are later used in Algorithm 1.

Generating the domain names
The generation of original AGD names can be executed either by botnets that already have a DGA mechanism implementation and are looking to extend it to evade detection, or by a new DGA implementation. Although the evasion technique works regardless of the selected DGA, the attacker should take into account two considerations: the average length and the number of generated domain names. The average length of the generated domain names represents a trade-off between the ease of evasion and the availability of the domain name generated for botnet communication. AGD names that are shorter (usually less than eight symbols) have a higher chance of being readable. Readable domain names have greater likelihood of evading detection, but on the other hand, they are more likely to be owned by legitimate users and thus unavailable for attacks. In addition, MaskDGA might make the provided domain names even more readable (while maintaining their length) and accordingly less available. In contrast, longer domain names are likely to be available and inexpensive. However, DGA classifiers are sensitive to the length of the domain names and are more likely to predict longer than average domain names as AGD names, regardless of their characters.
The number of generated domain names represents another trade-off between stealthy communication and resilient communication. DGAs that produce a very large number of domain names (e.g., thousands per day) are more difficult for take-down but are easier to identify because of the overall noise. An alternative is a DGA that produces a smaller number of domain names to choose a more stealthy communication. For instance: Banjori, Conficker and Gameover Zeus DGAs which generate thousands of domain names per day are ideal in terms of resilience, while Torpig and Matsnu generate up to three domain names per day and are better for stealthy communication [36].

Construct a Jacobian-based saliency map
The construction of the JSM begins by providing the substitute model with an AGD name X as performing a single feed forward step. For every AGD name, the feed forward step would provide a predicted probability distribution for the output classes of the substitute model. Based on the predicted probability distribution and the benign class distribution, we compute the targeted loss function L(F (X ), Y * ) of the predicted value F (X ) with respect to the benign class Y * . The back-propagation algorithm is then applied on the computed loss from the last hidden layer to the input layer so that every feature of the input X is assigned with a gradient. For example, the feature X i, j will be assigned with the real-value gradient ∂ L(F (X ),Y * ) ∂X 0, 0 . Formally, the JSM (denoted as S) is the set of the back-propagated gradients for every input feature:

Adding perturbation to the input AGD based on the JSM
The input character-level AGD X is added with a perturbation δ X so that following constraints are met: (1) X + δ X is a valid character-level representation of a domain name (see Subsection 2.1) (2) Exactly half of the characters of X are replaced The selection the perturbation δ X and the addition of its to transform X to X ′ is formally described in Algorithm 1. Initially, the algorithm computes the maximal value for every column in the JSM. The median of maximal value acts as a threshold and is henceforth denoted as Θ. MaskDGA replaces the character in position i to the j-th symbol in the alphabet if and only if the maximal value for column i of the JSM is j and j > Θ. The character replacement is performed by adding a perturbation δ X in which: (1) the original symbol is set to (−1), (2) the new symbol is set to (+1), and (3) the rest of the symbols are set to zero.
By definition, since Θ is the median of the maximal columns in the JSM that correspond to character positions, exactly half of the characters are replaced. The result is a new domain name X * which is the original X with the perturbation δ X that was induced by the algorithm.
Algorithm 1 Adding perturbation to an algorithmically generated domain name based on the JSM INPUT: X -a character-level AGD name of size |W | · |V | Y * -the targeted class F -is the function learned by the substitution model = 0 for all j j 10: return X * Figure 2: The attacker trains a substitute model on a publicly available dataset of AGD (1). A single feed forward step is performed using the substitute model on an input AGD name to compute the targeted loss with regard to the benign class (2). The targeted loss with regards to the benign class is used to back-propagate the gradients and construct the Jacobian-based saliency map (3) and add perturbation to the input AGD based on the JSM to result in a new adversarial domain names that evades detection (4).

EVALUATION 5.1 Overview
In this section we present the experiments conducted in order to evaluate the MaskDGA evasion technique. MaskDGA was tested on four recently presented models which are based on deep learning DGA classifiers using a public dataset of AGD names. The experiments focused on evaluating the effectiveness of MaskDGA while targeting the attacked models in general, as well as when focusing on a specific DGA family. The performance of MaskDGA was compared against two baseline attacks: (1) a random attack, which selects half of a domain's characters at random and replaces them with uniformly selected characters from the alphabet of English letters, digits, hyphens and underscores, and (2) an attack based on DeepDGA [3]. The DeepDGA-based attack was conducted using the source code provided by the authors of [3] with several modifications that were required in order to use it for the attack. After upgrading the source code so we could use the newer version of the Keras library [11] and applying it to a recent Alexa top 500,000 sites (as was done by Anderson et al. [3]), the generator produced a limited variety of samples. This is a common challenge in applying GANs, also known as mode collapse, which expresses the sensitivity of GAN architectures to minor changes in the configuration such as when using a different dataset [21]. Our understanding of the problem was that the generator was quickly over-fitted to the discriminator and failed to generate new samples. To overcome the mode collapse state we provided the discriminator with an initial advantage over the generator by pre-training the discriminator on a preliminary set of domain names that were generated by the generator before the training phase.

Datasets
The main dataset used for the evaluation is the DMD-2018 dataset [27,[47][48][49] which contains 100,000 benign domain names and 297,777 algorithmically generated domains that were evenly produced by twenty different DGA families (see Table 1). Additionally, the alexa.com dataset of top sites 2 was used to train the initial autoencoder of DeepDGA [4] as conducted by Anderson et al. [3]. Using the trained DeepDGA, we generated 500 adversarial domain names that were used to compare with MaskDGA, and an additional 63,500 domain names were used for the a defense as explained in Subsection 6.  4349  10148  503  murofet  4349  10148  503  necurs  3704  8644  429  newgoz  4349  10148  503  padcrypt  4349  10148  503  proslikefan 4349  10148  503  pykspa  4349  10148  503  qadars  4349  10148  503  qakbot  4349  10148  503  ramdo  4349  10148  503  ranybus  4349  10148  503  simda  4349  10148  503  suppobox  4349  10148  503  symmi  4349  10148  503  tempedreve 4349  10148  503  tinba  4349  10148  503   Total DGA 86335  201456  9986  Total  113335  264456  9986 The number of domain names in the dataset that are used for the evaluation. The substitute training set is used by the attacker to train the substitute model. The targeted training set is used to train a DGA classifier model that is targeted by the attacker. The test set contains an additional set of adversarial AGD names that are tested against the DGA classifiers.

Substitute model architecture
The architecture of the substitute model has the character-level (one hot encoding) representation of the domain as the input layer and an output neuron for every DGA family or benign domain as the output layer. The hidden layers consist of one-dimensional CNN filters of size 2, 3, 4, 5, and a max pooling layer that reduces the domain length to one half of its original and two additional fully-connected layers. This architecture was chosen because we wanted to evaluate the effectiveness of MaskDGA when using a model that is considerably weaker then the attacked DGA detection classifiers, and because it is lightweight and thus practical to apply. The training of the substitute model was conducted for five epochs with batches of 128 domain names until convergence using the ADAM optimizer [22] with a learning rate of 0.01.
The implementation of the evaluated adversarial evasion technique was achieved using the Keras library [11] and the TensorFlow library [1] for the substitute model and the Cleverhans library [29] for computing the gradients based on the targeted loss, and accordingly the JSM.
The character-level representations inputs for domain names are based on the vocabulary of English letters, digits, hyphens, underscores and dots. We (hard-coded) restrict the MaskDGA from adding perturbations that would change a non-dot character to a dot character. This restriction is designed to avoid the shortening of the second-level domain (e.g., "example.com" turns into "exa.mple.com") which has undesired effects on the effectiveness of the evasion technique (as explained in Section 1).

Targeted (attacked) models' architecture
The targeted models that MaskDGA tries to evade from detection are based on the following recently proposed DGA classifiers: The targeted models were implemented using the TensorFlow library [1] and are based on the source code that was published by [6] and trained on the the set of domain names that are reserved for the targeted model training in the dataset.

Evaluation metrics
The metrics used to evaluate the effectiveness of the evasion techniqued on the targeted models are precision, recall, and the F1-score, as is commonly used for DGA classification evaluation. Based on the threat model (see Section 3) where the goal is defined as targeted misclassification, we define the correct class as any DGA, instead of the specific DGA i.e., the classifier might predict the wrong DGA class but it is regarded correct as long as it did not misclassify an AGD as benign.
Precision computes the model's ability to assign the correct label out of all the instances in cluster label.
Precision(C, Y ) = correct class predict class Recall computes the model's ability to retrieve all of the instances of a certain class; i.e., the model's ability to retrieve all of the domains of a certain family.
Recall(C, Y ) = correct class entire class F1 score combines precision and recall together into one score using harmonic mean Based on the results, we can see that when no adversarial attack is applied (NoAttack), all of the models perform almost perfectly on the test set. More specifically, the targeted models yield an average precision (0.977), recall (0.977) and F1-score (0.977), thus supporting the claim that recently published, deep learning based DGA classifiers are very accurate in detecting AGD names.

Results
The Random attack shows a degradation in the average precision (-19%), recall (-26%), and F1-score (-26.5%), compared to the NoAttack case. This degradation in the evaluation measures indicates that the four targeted models are very sensitive to changes in the lexical patterns of DGA-based domain names.
The DeepDGA attack consists of generating pseudo-random domain names that are sampled from the same distribution of the benign Alexa top 1M domains using a GAN network. While clearly degrading the performance of the detection models in comparison to the NoAttack case, the DeepDGA generated domains are effectively detected by all four models with a higher average precision (+6%), recall (+5%) and F1-score (+0.3%) compared to the Random attack. The generation of domain names by DeepDGA relies on sampling symbols from a pre-trained multinomial regressor that provides the likelihood for every symbol at a given position. The sampling is performed independently for every position, and thus it is not guaranteed that the output domain name would not appear to be algorithmically generated. The MaskDGA evasion technique dominates all evaluated attacks on all four targeted models with an average recall rate of 0.575; i.e., an average DGA classifier would miss 42.5% of the AGD names compared to only 2.5% in the NoAttack case.
We were also interested in evaluating the effectiveness of the evasion technique on specific DGA families that are characterized by different patterns. Table 3 presents the F1-score (which reflects the harmonic mean between the precision and recall) for the twenty DGA families that are available in the test set.
When NoAttack is applied, a similar average F1-score for all DGA families is observed. This indicates that the models memorize the lexicographical patterns of observed domains regardless of their length.
The Random attack, when focusing on the specific DGA families, results in a more significant degradation for some DGAs (e.g., Simda, Suppobox) than others (e.g., CoreBot, Symmi). The Note that in this analysis the DeepDGA could not be evaluated (and thus was omitted) because its input is a seed string and not AGD that were produced by DGA processes. Finally, Table 4 contains examples of AGD that were generated by several DGA families and their adversarial form after adding perturbation by MaskDGA in order to provide further intuition. As  The average F1-score of the targeted DGA classifiers on twenty DGA families when: no attack is applied (N oAt t ack ), a random attack is performed (Random), and when executing the presented evasion technique (M ask DGA).
described in Section 4, the characters that are replaced by MaskDGA are the ones that have the highest saliency with regards to a misclassification as the benign class. Accordingly, the provided examples inflict two interesting trends. The clearest trend is that the underscore ("_") characters is frequently used by MaskDGA since it is valid and common for benign domain names that appeared on the DMD-2018 dataset but never appeared on any in the dataset, and at all to the best of our knowledge. Another trend is the use of digits, especially in the prefix of domain names which is relatively rare for AGD. Also, note that the pykspa domain "abfmfid.net" resulted in the adversarial domain name "poqhfid.net" that involves a consonant-vowel-consonant (CVC) pattern that is common in English readable words, and accordingly in benign domains.

EVALUATION OF ADVERSARIAL DEFENSES 6.1 Overview
The emergence of adversarial attacks was followed by studies that suggested appropriate defenses. In this section we evaluate the effectiveness of two common adversarial defenses, namely adversarial re-training and distillation, against the presented MaskDGA evasion technique.

Tested defenses
The first defense evaluated is adversarial re-training. In adversarial re-training [53] the training set is augmented with adversarial samples so that the resulting model is more robust to adversarial samples. While re-training is considered an effective defense against adversarial samples, it requires prior knowledge of the defender about the attack and it does not necessarily generalize to other attacks [19]. We tested two different adversarial re-training processes: re-training using MaskDGA (denoted as MaskDGA re-train) and re-training using DeepDGA (denoted as DeepDGA re-train).
In MaskDGA re-train each DGA classifier (i.e., the targeted model) is initially trained on the same training set as described in Section 5.2. Then, we randomly selected one hundred AGD names from each of the twenty DGA families (2,000 domains in total) and applied the MaskDGA on them. The targeted model was then retrained for two additional epochs on a new training set that consists of the original training set and the 2,000 adversarial samples.
In order to apply DeepDGA re-train, we first trained the Deep-DGA GAN architecture using 500k benign domain names and output 63,500 pseudo-random domain names. As suggested by Anderson et al. [3], we extend the training set of the targeted model with these domain names which are labeled as the "benign" class, in order to defend against adversarial attacks.
Distillation networks [33] were proposed as a defense against adversarial perturbation that uses a special parameter called the "distillation temperature" T . Setting high temperature values (e.g., T = 10): for the softmax layer as induces smoother decision bounds as follows: where Softmax(X ,T ) is the softmax layer, T is the temperature, and z i is the i-th logit. After training the initial network with a high distillation temperature, the softmax values obtained (denoted as "soft labels") are now used to train a new network (denoted as the "distilled network") which is more resistant to attacks. As a general adversarial defense, distillation networks have been evaluated on adversarial attacks against the MNIST [26] and CIFAR-10 [24] datasets and for both the effectiveness of the attacks dropped from a 95% of misclassification rate to less than 5%. The main intuition regarding the reduced effectiveness of attacks is that the distilled soft labels allow samples that are in between labels (e.g., a figure of the digit '3' that resembles an '8') to be classified near the decision boundary instead of in the center, which makes the trained model vulnerable to attacks.
Our implementation of the distillation defense relies on the implementation of [10], in which the same temperature was used for both the initial and distilled networks, respectively named teacher and student. Moreover, setting the temperature to values that are larger than 40, as was done on images in [33], failed to converge for DGA detection in which the classes of samples more often overlap. Therefore, we set the temperature to 10. Table 5 presents the average F1-score measure of the four models in the cases of NoAttack, DeepDGA attack, and MaskDGA attack, and when no defense is applied (NoDe f ense), when using MaskDGA retrain, DeepDGA retrain, and Distillation.

Results
The results presented in Section 5.6 indicate that, when no defense is applied, the models are vulnerable to domain names that were generated by the DeepDGA attack and even more vulnerable to to domain names that were generated by MaskDGA.
The distillation network defense slightly improves the F1-scores against all attacks and across all models but is inefficient overall. The primary reason for the inefficiency of the distillation defense is that it is designed for general misclassification (i.e., misclassification for any other class other than the correct class Y ) and not a targeted misclassification (i.e., a misclassification for a specific class Y ′ ).
The DeepDGA retrain defense significantly improve the robustness of the targeted models against the DeepDGA attack for three of the four models (all but CMU). The DeepDGA hardening is ineffective against the MaskDGA evasion technique, but it comes with the cost of reducing the effectiveness of detecting non-adversarial AGD names.
The MaskDGA retrain defense provides the highest average F1score results on all of the attacks and for all targeted models. The effectiveness of detecting non-adversarial AGD names is still reduced in comparison to the targeted models without any defense, but overall it has better results on average, than the alternatives of DeepDGA hardening and distillation networks. The effectiveness of the defense against the DeepDGA attack has an average F1-score of 0.6675, which is better than the effectiveness of the DeepDGA retrain defense against the MaskDGA evasion technique. This suggests that overall, the defenses do not fully prevent general adversarial attacks against DGA classifiers.

PRACTICAL IMPLEMENTATION OF MASKDGA
Resilient communication between bots and their command and control server using a DGA is normally established as follows. The bot operator and the bots have an implementation of the DGA mechanism in their source code and share a secret input seed. Periodically, the botnet operator executes the DGA with the secret input seed to generate a large number of domain names and attempts to register them. The domain names that are successfully registered, are configured by the bot operator to resolve to the command and control system. In turn, the bot executes the DGA with the shared secret input seed to generate the same list of domain names that was generated by the bot operator. The bot iterates the generated domain names and attempts to connect each one of them until it receives a reply from from the command and control server. The bot that executes the DGA might reside on hosts which have limited computational and storage resources (e.g., IoT devices or point-of-sale machines). Therefore, it is important to understand the practical implementation of the presented evasion technique in order to understand its requirements and limitations. Evaluation of the average F1-score of targeted models when applying the distillation, DeepDGA retrain and adversarial retrain defenses. 38.4KB / AGD -The platform and memory requirements of a bot to execute MaskDGA. A bot would load a pre-trained substitute model using TensorFlow Lite that is supported on various environments and represent every AGD input and output JSM representation as a binary character-level matrix in memory.
MaskDGA requires the bot to generate a set of AGD, use a substitute model to perform a feed-forward step and back-propagation to acquire the JSM, and add perturbation based on the JSM. We assume that bots that have previously used DGAs are capable of generating a set of AGD names. Therefore, the main focus of this section the requirements of representing the AGD names as character-level binary matrices, loading a previously trained substitute model, and computing the JSM. The list of requirements is summarized in Table 6.
The longest AGD name in the rich DMD-2018 dataset has 65 characters, and the number of allowed symbols for domain names include case-insensitive English letters, digits, hyphens, underscores and dots, for an overall of 39 symbols. There a binary characterlevel representation of 65 · 39 = 2535 entries of bits is sufficient for the representation every single AGD name.
The substitute model that we trained can be serialized to the HDF5 binary serialization format 3 and later re-loaded with Tensor-Flow. Since TensorFlow's development libraries often exceeds 100 MB, TensorFlow Lite 4 can be used. TensorFlow Lite weighs less than 300 KB and is designed to load pre-trained models on Android, embedded devices and Desktops and supports various programming languages such as:: C, C++, Java and Python. The substitute model that was trained in Section 4.2 had 160,853 parameters and is serialized to a 10MB HDF5 file.
For every AGD name the attacker is required to perform a single feed-forward step and a single back-propagation which is negligible in computation resources (since no training is required). The result of the backpropagation is the JSM matrix of gradients that has a similar number of entries to that of the input representation (2,535), but in contrast, every entry has 16 bits instead of a single bit. Therefore, the overall JSM representation has slightly less than 38.4KB per AGD name.

CONCLUSIONS
This study portrays an adversarial machine learning evasion technique on DGA classifiers. The evaluation of the evasion technique on four state of the art, recently published DGA classifiers indicates that their performance degrades significantly. MaskDGA is evaluated along with two other attacks, DeepDGA and random, which also resulted in a degradation in the performance of the DGA classifiers, although to a lesser extent than that caused by the MaskDGA. The performance degradation caused by the random attack helps us argue that character-level DGA classifiers memorize specific lexicographic patterns of known DGA and thus are extremely vulnerable to adversarial attacks.
The GAN architecture used by DeepDGA (1) requires extensive hyper-parameter tuning, (2) does not easily converge, and therefore is unstable and unexpected, (3) requires an approximation technique to address the discrete values of the input (i.e., the domain name), and (4) was trained to generate domains based on legitimate character distribution, and therefore is likely to generate benign (already registered) domain names. On the other hand, the MaskDGA technique is (1) designed specifically for generating malicious domains (i.e., the substitute model is trained using both legitimate and malicious domains) and is therefore more successful, (2) requires minimal tuning (it only requires training a simple substitute model), and (3) is applied as a wrapper on the original DGA mechanism used by the botnet. Moreover, MaskDGA can be executed by bots with limited resources as long as they install TensorFlow lite (supported on multiple platforms) and load a pre-trained model that weighs less than 10MB, thus making the evasion technique practical for botnets.
Additionally, we tested MaskDGA and the DeepDGA attack against three adversarial defenses, namely: MaskDGA re-training, DeepDGA re-training and distillation networks. We conclude that distillation is ineffective against targeted misclassifications. The DeepDGA retraining was effective against the DeepDGA attack but caused the targeted model to degrade against non-adversarial AGD names. Finally, MaskDGA re-training on the MaskDGA adversarial samples had better results on average, but it still does not provide a perfect defense against other adversarial attacks such as DeepDGA. These results demonstrate the vulnerability of character-level DGA classifiers to adversarial attacks and potential solutions to that are further discussed in Section 10.

RELATED WORKS
The concept of using adversarial learning for generating malicious adversarial samples was previously investigated by [20,38,39,44] for generating malware that evade machine learning-based antimalware software and [14,17] for evading text classifiers.
DeepDGA [3] extended these studies to the area of DGA detection by proposing a generative adversarial learning application that generates pseudo-random domain names that appear legitimate and thus can be used to augment the benign class in the training set for classification robustness. DeepDGA can be regarded as both an evasion technique that produces pseudo-random domain names and as a defense mechanism for classification robustness. As an evasion technique, DeepDGA is impractical for botnets as the generated domains are short and readable and therefore either expensive or not available for carrying out large attacks by botnets. Moreover, the performance of MaskDGA is superior to that of DeepDGA and simpler to implement and tune, since it is based on a discriminative model which is less complicated computationally than generative models.
Character-level adversarial attacks were previously suggested in HotFlip [16] to cause misclassification of words by text classifiers in the white-box adversarial setting by replacing, inserting or deleting a single character. In contrast, the presented evasion technique is applied in a black-box adversarial setting in which a substitute model is trained. Also, deleting or inserting characters is forbidden to avoid the generation of longer domain names which are sensitive to detection and short domain names which are more expensive and less available. In addition, in MaskDGA the replacement of characters is performed on half of the characters, where every character is replaced once, in order to preserve a unique set of generated domains. In contrast, HotFlip always focuses on the character that induces the highest gradient since there's no restriction of replacing multiple words to the same words. For example, the words "open, " "pea," and "ten" can all change to the word "pen" in a single flip, but MaskDGA ensures that the chances of outputting the same domain is small, resulting in a larger unique domain names, and accordingly making it difficult to detect all of the generated domain names.

DISCUSSION AND FUTURE WORK
Character-level DGA classifiers gained popularity largely due to their simplicity, the availability of training data, and the ability to use them for real-time detection. We therefore aimed at evaluating the robustness of these classifiers against evasion techniques. Since the evaluation of MaskDGA indicates the vulnerability of these classifiers, we propose potential solutions for improved robustness. Firstly, DGA classifiers can improve their robustness against adversarial attacks using additional contextual features (e.g., DNS traffic features and WHOIS features [5,13,41]) are also being used for classification. Another approach for robustness should focus on DGA detection systems that would detect domain names with novel lexicographic representation that implies the existence of either a new DGA process, a new secret seed or an adversarial attack.
MaskDGA can be generalized for other security scenarios, as well as non-security scenarios, in which character-level classifiers attempt to predict the malice of a sample. For example, phishing URLs classifiers can re-crafted using the presented technique to evade detection, and malware strings can be automatically replaced to overcome signature-based anti-malware tools. We believe that using MaskDGA for adversarial re-training can improve the robustness of the models in these cases as well.