More than Words is What you Need - Detecting DGA and Phishing Domains with Dom2Vec Word Embeddings

The rapid detection of Domain Generation Algorithm (DGA) and general phishing domains plays a critical role in mitigating malware propagation and its potential impact, as well as in limiting botnet activity coordination through command and control (C&C) servers. We assess a learning driven approach for accurate detection of DGA-generated and phishing domains, leveraging word embeddings learned from observed domain names in DNS queries or browsing URLs. Domain embeddings are constructed with Dom2Vec (D2V), a novel technique which builds on top of word embedding models (e.g., Word2Vec) to map words and tokens extracted from domain names into highly expressive representations. Through experimental evaluation on a large-scale dataset of almost 800,000 domains, comprising 25 distinct families of DGA domains and general phishing URLs, we demonstrate the goodness of D2V embeddings for phishing detection, in particular for the detection of DGAs.