Applying Intrusion Detection Based on Algorithmically Generated Domain Classification to Real Network Traffic

Domain Generation Algorithms (DGAs) are used by malware in establishing a connection with the Command and Control (C&C) server, to reduce the risk of the connection being identified by changing the C&C domain name dynamically but predictably. Since malicious Algorithmically-Generated Domains (mAGDs) have identifiable patterns, suitably trained Machine Learning (ML) models, here called mAGD classifiers, are often able to identify such domains. However, these results are typically obtained in a non-temporal context, raising uncertainty about their applicability in real-world scenarios. In reality, network traffic is time-dependent and extremely variable, and false positives have a significant impact. One way to mitigate these problems is to analyze connections not one at a time, but by grouping those occurring in a predetermined time interval. In this paper we address such a challenge, showing that, even when the mAGD classifier has very good performance in classifying individual domain names, its output needs to be carefully post-processed in order to achieve good overall intrusion detection performance on real network traffic.