To Örebro University

oru.seÖrebro University Publications
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Adversarial Defense: DGA-Based Botnets and DNS Homographs Detection Through Integrated Deep Learning
Center for Artificial Intelligence, Prince Mohammad Bin Fahd University, Khobar, Saudi Arabia.
College of Engineering, IT and Environment, Charles Darwin University, Darwin NT, Australia.
Center for Computational Engineering and Networking, Amrita School of Engineering, Coimbatore Amrita Vishwa Vidyapeetham, Coimbatore, India.
Örebro University, School of Science and Technology. (MRO AASS)ORCID iD: 0000-0003-1827-9698
Show others and affiliations
2023 (English)In: IEEE transactions on engineering management, ISSN 0018-9391, E-ISSN 1558-0040, Vol. 70, no 1, p. 249-266Article in journal (Refereed) Published
Abstract [en]

Cybercriminals use domain generation algorithms (DGAs) to prevent their servers from being potentially blacklisted or shut down. Existing reverse engineering techniques for DGA detection is labor intensive, extremely time-consuming, prone to human errors, and have significant limitations. Hence, an automated real-time technique with a high detection rate is warranted in such applications. In this article, we present a novel technique to detect randomly generated domain names and domain name system (DNS) homograph attacks without the need for any reverse engineering or using nonexistent domain (NXDomain) inspection using deep learning. We provide an extensive evaluation of our model over four large, real-world, publicly available datasets. We further investigate the robustness of our model against three different adversarial attacks: DeepDGA, CharBot, and MaskDGA. Our evaluation demonstrates that our method is effectively able to identify DNS homograph attacks and DGAs and also is resilient to common evading cyberattacks. Promising results show that our approach provides a more effective detection rate with an accuracy of 0.99. Additionally, the performance of our model is compared against the most popular deep learning architectures. Our findings highlight the essential need for more robust detection models to counter adversarial learning.

Place, publisher, year, edition, pages
IEEE, 2023. Vol. 70, no 1, p. 249-266
Keywords [en]
Botnet, cybercrime, cyber security, deep learning (DL), DNS attacks, domain generation algorithms (DGAs), domain name system (DNS), malware
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:oru:diva-91572DOI: 10.1109/TEM.2021.3059664ISI: 000732665500001OAI: oai:DiVA.org:oru-91572DiVA, id: diva2:1549031
Available from: 2021-05-04 Created: 2021-05-04 Last updated: 2023-02-02Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full text

Authority records

Arunachalam, Ajay

Search in DiVA

By author/editor
Arunachalam, Ajay
By organisation
School of Science and Technology
In the same journal
IEEE transactions on engineering management
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 147 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf