Unknown DGAs Detection Based on TextCNN and Autoencoder

Botnets pose a significant threat to Internet information systems, leveraging Domain Generation Algorithm (DGA) for malicious activities such as denial-of-service, spam, and malware distribution. Current research of DGA in machine learning and deep learning has primarily focused on binary classification of known DGAs, resulting in reduced accuracy when confronted with unknown DGAs due to the increasing diversity of DGAs. This paper addresses this challenge by proposing a novel approach utilizing a domain-specific tokenizer and the TextCNN for multi-classification of known DGAs, augmented by Autoencoder (AE) and extreme value theory (EVT) for accurate identification of unknown DGAs. Our method builds upon the insight that AE reconstruction errors are typically higher for unknown DGAs compared to known ones. To further enhance precision, we introduce an EVT-based algorithm to estimate confidence probabilities for recognition outcomes. Our approach aims to accurately identify unknown DGAs in addition to performing multi-class classification of known DGAs using deep learning methods (TextCNN and Autoencoder). Experimental results on real-world DGA datasets suggest improvements in recognition accuracy compared to conventional baseline methods.