Malicious Domain Names Detection Algorithm Based on N-Gram

• Published in: Journal of computer networks and communications Vol. 2019; no. 2019; pp. 1 - 9
• Main Authors: Zeng, Xiang-Yan, Bao, Guangbin, Chang, Zhaobin, Hong, Zhao
• Format: Journal Article
• Language: English
• Published: Cairo, Egypt Hindawi Publishing Corporation 01.01.2019; Hindawi; John Wiley & Sons, Inc; Wiley
• Subjects: Algorithms; Behavior; Blacklisting; Computer networks; Computer simulation; Cybersecurity; Domain names; International conferences; Internet; Malware; Mathematical analysis; Semantics; Servers; Trademarks; URLs; Weight
• ISSN: 2090-7141; 2090-715X; 2090-715X
• DOI: 10.1155/2019/4612474

Malicious domain name attacks have become a serious issue for Internet security. In this study, a malicious domain names detection algorithm based on N-Gram is proposed. The top 100,000 domain names in Alexa 2013 are used in the N-Gram method. Each domain name excluding the top-level domain is segmented into substrings according to its domain level with the lengths of 3, 4, 5, 6, and 7. The substring set of the 100,000 domain names is established, and the weight value of a substring is calculated according to its occurrence number in the substring set. To detect a malicious attack, the domain name is also segmented by the N-Gram method and its reputation value is calculated based on the weight values of its substrings. Finally, the judgment of whether the domain name is malicious is made by thresholding. In the experiments on Alexa 2017 and Malware domain list, the proposed detection algorithm yielded an accuracy rate of 94.04%, a false negative rate of 7.42%, and a false positive rate of 6.14%. The time complexity is lower than other popular malicious domain names detection algorithms.