A method for detecting DGA botnet based on semantic and cluster analysis

摘要: Botnets play major roles in a vast number of threats to network security, such as DDoS attacks, generation spam emails, information theft. Detecting is difficult task due the complexity and performance issues when analyzing huge amount data from real large-scale networks. In Botnet malware, use Domain Generation Algorithms allows decrease possibility be detected using white list - blacklist scheme thus DGA have higher survival. This paper proposes detection based on DNS traffic analysis which utilizes semantic measures entropy, meaning level domain, frequency n-gram appearances Mahalanobis distance for domain classification. The proposed method an improvement Phoenix botnet mechanism, where classification phase, modified used instead original clustering phase k-means algorithm archiving better effectiveness. effectiveness was measured compared with Phoenix, Linguistic SVM Light methods. experimental results show accuracy ranges 90 99,97% depending type.