Not all DGAs are Born the Same - Improving Lexicographic based Detection of DGA Domains through AI/ML

Timely identfication of DNS queries to Domain Generation Alogorithm (DGA) domains is crucial to limit malware propagation and its potential impact, particularly to prevent coordinated activites of botnets. We explore an approach for swift detection of DGA-generated domains by analyzing lexicographic features exclusively derived from the domain name as observed in DNS query. We propose a reputation-based scoring system for domain names, based on the co-occurrence frequency of n-grams with respect to a list of well-known benign domains or whitelist. We further extract meaningful features from domain names and employ machine learing techniques to enhance detection performance. Experimental results on detecting 25 different families of DGA domains reveal that combining reputation scores with other basic lexicographic features largely outperforms current state of the art approaches.