WCDGA: BERT-Based and Character-Transforming Adversarial DGA with High Anti-Detection Ability

Domain Generation Algorithms (DGAs) are essential for creating numerous domain names automatically, commonly used to make malicious domains more stealthy and persistent online. To counteract DGAs, deep learning-based detection methods have been proposed, significantly reducing the effectiveness of traditional DGAs. However, due to inherent vulnerabilities in deep learning models, these detection methods are susceptible to adversarial attacks. Existing adversarial DGAs focus on character-based detection methods but overlook word-based structures, leading to weak performance against advanced word-based detection methods like graph neural networks. In this paper, we propose an innovative adversarial method and name it Word-Character DGA (WCDGA). The main idea is to create domain names by combining high-frequency words with common prefixes and suffixes found in reputable domains. This process utilizes a bidirectional encoder (BERT) and implements character transformations based on edit distance. We evaluate WCDGA against established character-based DGA detection methods (LSTM.MI, MIT, NYU) and the latest word-based method DGGCN. The results demonstrate that WCDGA out-performs existing adversarial DGAs in its evasion capabilities, successfully bypassing multiple detection methods simultaneously. Index Terms—Domain generation algorithm, Anti-detection, Dictionary generation, Character transformation