A Comprehensive Study on Multi-Task Learning for Domain Generation Algorithm (DGA) Detection

International Conference on Privacy, Security and Trust (PST), pp. 1–10

Abstract

In this work, we perform a comparative evaluation of 21 approaches to multi-task learning (MTL) for the detection of domain generation algorithms (DGAs). To this end, we train and evaluate 2300 classifiers using a combination of 14 different optimization strategies and 6 MTL architectures and compare them statistically with the state of the art. In this context, we propose a novel ResNet backbone, which already surpasses the state of the art on its own, but shines especially in combination with MTL. We evaluate the novel DGA classifiers in a real-world study that avoids temporal and spatial experimental biases to assess whether they generalize well between different networks and are robust over time. Moreover, we analyze the classifiers' capability to detect yet unknown DGAs and discuss their practical application. Our best-performing classifier surpasses the state of the art by over 5.7% in area under the curve (AUC) for practically relevant false-positive rates (FPRs) and exceeds the state of the art by over 7.3% in true-positive rate (TPR) at the same fixed FPR of 0.001 in a real-world setting.

Authors 2

1. Arthur Drichel Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University

2. Ulrike Meyer Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University