论文标题
PKDGA：一种基于部分知识的领域生成算法
PKDGA: A Partial Knowledge-based Domain Generation Algorithm for Botnets
论文作者
论文摘要
域生成算法（DGA）可以分为三种：零知识，部分知识和全知。尽管先前的研究仅关注零知识和全知类型，但我们表征了它们的抗检测能力和实用性，并发现零知识DGA对检测器具有低的抗检测能力，并且由于强有力的假设是完全检测器，而全面知识的DGA遭受了低实用性。鉴于这些观察结果，我们提出了PKDGA，这是一种基于部分知识的领域生成算法，具有高抗检测能力和高实用性。 PKDGA采用了增强学习体系结构，这使其仅基于探测器易于观察的反馈自动进化。我们使用一组现实世界数据集评估PKDGA，结果表明，它将现有检测器的检测性能从91.7％降低到52.5％。我们进一步将PKDGA应用于Mirai恶意软件，评估表明，所提出的方法非常轻巧且及时。
Domain generation algorithms (DGAs) can be categorized into three types: zero-knowledge, partial-knowledge, and full-knowledge. While prior research merely focused on zero-knowledge and full-knowledge types, we characterize their anti-detection ability and practicality and find that zero-knowledge DGAs present low anti-detection ability against detectors, and full-knowledge DGAs suffer from low practicality due to the strong assumption that they are fully detector-aware. Given these observations, we propose PKDGA, a partial knowledge-based domain generation algorithm with high anti-detection ability and high practicality. PKDGA employs the reinforcement learning architecture, which makes it evolve automatically based only on the easily-observable feedback from detectors. We evaluate PKDGA using a comprehensive set of real-world datasets, and the results demonstrate that it reduces the detection performance of existing detectors from 91.7% to 52.5%. We further apply PKDGA to the Mirai malware, and the evaluations show that the proposed method is quite lightweight and time-efficient.
