Detection of information system objects interaction with DGA domains

Currently, malware developers are actively using domain name generation technique called DGA to es-tablish communication between malware and its command centers. Domain name generation in accord-ance with the given algorithm allows malicious software to bypass information protection tools blacklists, thus making blacklists ineffective, and establish a communication channel to receive control commands and parameters, as well as to transfer information from the information system to external resources con-trolled by attackers. Thus, it is necessary to develop new approaches to DGA generated domain names de-tection using DNS traffic of an information system. During the research, the authors have developed a solution for detecting information objects interaction with DGA domains based on the use of machine learning. The detection of this interaction occurs in two stages. On the first stage the classification task is being solved for each DNS name from overall infor-mation system DNS stream. On the second stage, for each DNS name classified as DGA, corresponding DNS query is being enriched using data from external sources and a final decision about the malicious nature of the query to resolve this DNS name is being made, followed by a notification of a security admin-istrator via e-mail channels. The paper describes the process of developing a classifier based on machine learning, defines the input data of the DNS name necessary for classification, presents the results of classifier training on a repre-sentative set of test data. The logic of making a decision about the malicious nature of DNS queries has been substantiated. The developed solution was tested using an experimental stand. Some recommenda-tions for correct classifier operation support are proposed. The application of the developed solution will make possible posteriori detection of information interac-tion of malicious software working on compromised information objects with the servers of attackers com-mand and control centers.