CPDGA: foresee future DGA using proactive conformal propagation - LIU Shuangshuang; WANG Zhi; DONG Yimeng; LI Wanpeng (Tongxin xuebao)
Attackers dynamically register domain names through the domain generation algorithm (DGA) to support malware activities. The continuous evolution of malicious domain names leads to the phenomenon of concept drift, rendering the existing detection techniques based on continual learning models less effective over time. To address this threat, by combining conformal prediction and conformal clustering, a foresee future DGA using proactive conformal propagation (CPDGA) was proposed. Experiments were conducted using datasets of malicious and benign domain names from 2019 to 2023. CPDGA was applied to mitigate the effect of concept drift. As a result, the impact of concept drift was effectively reduced. The detection accuracy was improved by 20.4%. Additionally, CPDGA achieves an accuracy rate of 96.42% in detecting the domain names generated by 13 latest adversarial models, showing its strong robustness and adaptability.