Which DGA Family does A Malicious Domain Name Belong To

Abstract

The Domain Generation Algorithm (DGA) is a technology that generates a large amount of domains in a short time, commonly applied to malware by malicious attackers to circumvent the security mechanisms, such as domain blacklist. Besides discovering DGA domains, identifying DGA families also is significant for detecting and analyzing malware, which provides security professionals with the perspective of comprehensive analysis. In this paper, we investigate 22 different DGA families and propose an effective approach to portray and classify DGA families, which utilizes the strong host association and family portrait to identify different DGA families among massive DGA domains. The approach mitigates the hurdle caused by the nearly 100 times data difference among different families, implementing DGA family clustering. The experimental results show that the proposed approach identifies all of the DGA families accurately in the network that contains six families.