A Classification Method Based on CNN-BiLSTM for Difficult Detecting DGA Domain Name

DGA (Domain Generation Algorithm) domain name detection is one of hot topics in cyber security, as DGA domain names are constantly updated to improve concealability. Characteristics of DGA domain names become more implicit and complex, so the detection effect of traditional deep learning models on some DGA domain names is not well. This paper studied characteristics of DGA domain name and proposed a detection model based on CNN and BiLSTM, which could extract local phrase features and bidirectional global dependence features from multiple dimensions. Experimental results show that CNN-BiLSTM model proposed in this paper can significantly improve the detection effect of wordlist-based DGA domain name, shorter-length DGA domain name, and small-member DGA domain name both in two-classification and multi-classification. In two-classification, the performance of CNN-BiLSTM model was the best, precision reached 93.11%, recall reached 95.95%, and F1 score reached 94.51%. Evaluation indexes of CNN-BiLSTM model were around 3% higher than the other two models. In multi-classification, precision reached 91.02%, recall reached 92.33%, and F1 score reached 91.57%. They were about 2.5% higher than BiLSTM model and much higher than CNN model. Moreover, CNN-BiLSTM model could detect more DGA families.