Popularity-Based Detection of Domain Generation Algorithms

Jasper Abbink, Christian Doerr

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

4 Citations (Scopus)


In order to stay undetected and keep their operations alive, cyber criminals are continuously evolving their methods to stay ahead of current best defense practices. Over the past decade, botnets have developed from using statically hardcoded IP addresses and domain names to randomly-generated ones, so-called domain generation algorithms (DGA). Malicious software coordinated via DGAs leaves however a distinctive signature in network traces of high entropy domain names, and a variety of algorithms have been introduced to detect certain aspects about currently used DGAs.

In this paper, we look ahead and evaluate the utility of today's detection mechanisms if botnets make the next obvious evolutionary step, and replace domain names generated from random letters with randomly selected, but actual dictionary words. We find that the performance of state-of-the-art solutions that rely on linguistic feature detection would significantly decline after this transition, and discuss an alternative novel approach to detect DGAs without making any assumptions on the internal structure and generating patterns of these algorithms.
Original languageEnglish
Title of host publicationARES 2017
Subtitle of host publicationProceedings of the 12th International Conference on Availability, Reliability and Security
Place of PublicationNew York, NY
PublisherAssociation for Computing Machinery (ACM)
Number of pages8
ISBN (Electronic)978-1-4503-5257-4
Publication statusPublished - 2017
EventARES 2017: 12th International Conference on Availability, Reliability and Security - Reggio Calabria, Italy
Duration: 29 Aug 20171 Sep 2017
Conference number: 12


ConferenceARES 2017
CityReggio Calabria


  • malware
  • domain-generation-algorithm
  • threat intelligence

Fingerprint Dive into the research topics of 'Popularity-Based Detection of Domain Generation Algorithms'. Together they form a unique fingerprint.

Cite this