Modulating LSTMs of Data-Driven Domain Features for DGA Detection: A Semantic Context-Dependent Method

Botnets pose a significant security threat to Internet infrastructure, enabling malicious activities such as DDoS attacks and information theft. Attackers employ Domain Generation Algorithms (DGAs) to generate constantly changing domain names for their Command and Control (C&C) servers, evading detection. Traditional rule-based and machine learning approaches for DGA detection have limitations in handling novel DGA variants and wordlist-based domains. In this paper, we propose BPBZ, a byte-pair encoding (BPE) based pipeline framework for fine-grained DGA classification. The framework incorporates a BPE-based tokenizer for optimized subword segmentation, Word2Vec for contextual word embeddings, and ZmLSTM, an enhanced variant of LSTM, for modeling semantic and context-dependent characteristics of domain names. Through extensive empirical evaluation, BPBZ achieves state-of-the-art performance for DGA detection across both full-size and small-size datasets. Moreover, it exhibits top-tier detection capabilities for arithmetic-based, hash-based, and wordlist-based DGAs.