{"id":"https://openalex.org/W2954590176","doi":"https://doi.org/10.1109/access.2019.2927075","title":"CharBot: A Simple and Effective Method for Evading DGA Classifiers","display_name":"CharBot: A Simple and Effective Method for Evading DGA Classifiers","publication_year":2019,"publication_date":"2019-01-01","ids":{"openalex":"https://openalex.org/W2954590176","doi":"https://doi.org/10.1109/access.2019.2927075","mag":"2954590176"},"language":"en","primary_location":{"id":"pmh:oai:digitalcommons.tacoma.uw.edu:tech_pub-1375","is_oa":false,"landing_page_url":"https://digitalcommons.tacoma.uw.edu/tech_pub/373","pdf_url":null,"source":{"id":"https://openalex.org/S4306400628","display_name":"University of Washington Tacoma Digital Commons (University of Washington Tacoma)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210150356","host_organization_name":"University of Washington Tacoma","host_organization_lineage":["https://openalex.org/I4210150356"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"School of Engineering and Technology Publications","raw_type":"text"},"type":"article","indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Nascimento, A. C.","orcid":null},"institutions":[{"id":"https://openalex.org/I32597200","display_name":"Ghent University","ror":"https://ror.org/00cv9y106","country_code":"BE","type":"education","lineage":["https://openalex.org/I32597200"]},{"id":"https://openalex.org/I4210150356","display_name":"University of Washington Tacoma","ror":"https://ror.org/05n8t2628","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701","https://openalex.org/I4210150356"]}],"countries":["BE","US"],"is_corresponding":false,"raw_author_name":"Nascimento, A. C.","raw_affiliation_strings":["University of Washington Tacoma","Department of Applied Mathematics, Computer Science and Statistics, Ghent University, Ghent, Belgium"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Washington Tacoma","institution_ids":["https://openalex.org/I4210150356"]},{"raw_affiliation_string":"Department of Applied Mathematics, Computer Science and Statistics, Ghent University, Ghent, Belgium","institution_ids":["https://openalex.org/I32597200"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056749857","display_name":"Martine De Cock","orcid":"https://orcid.org/0000-0001-7917-0771"},"institutions":[{"id":"https://openalex.org/I4210150356","display_name":"University of Washington Tacoma","ror":"https://ror.org/05n8t2628","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701","https://openalex.org/I4210150356"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"De Cock, Martine","raw_affiliation_strings":["University of Washington Tacoma","School of Engineering and Technology, University of Washington at Tacoma, Tacoma, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Washington Tacoma","institution_ids":["https://openalex.org/I4210150356"]},{"raw_affiliation_string":"School of Engineering and Technology, University of Washington at Tacoma, Tacoma, WA, USA","institution_ids":["https://openalex.org/I4210150356"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089846651","display_name":"Jonathan Peck","orcid":"https://orcid.org/0000-0003-2929-4164"},"institutions":[{"id":"https://openalex.org/I4210150356","display_name":"University of Washington Tacoma","ror":"https://ror.org/05n8t2628","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701","https://openalex.org/I4210150356"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peck, Jonathan","raw_affiliation_strings":["School of Engineering and Technology, University of Washington at Tacoma, Tacoma, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Engineering and Technology, University of Washington at Tacoma, Tacoma, WA, USA","institution_ids":["https://openalex.org/I4210150356"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022429768","display_name":"Claire Nie","orcid":null},"institutions":[{"id":"https://openalex.org/I4210150356","display_name":"University of Washington Tacoma","ror":"https://ror.org/05n8t2628","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701","https://openalex.org/I4210150356"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nie, Claire","raw_affiliation_strings":["School of Engineering and Technology, University of Washington at Tacoma, Tacoma, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Engineering and Technology, University of Washington at Tacoma, Tacoma, WA, USA","institution_ids":["https://openalex.org/I4210150356"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013099146","display_name":"Raaghavi Sivaguru","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sivaguru, Raaghavi","raw_affiliation_strings":["Infoblox, Santa Clara, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Infoblox, Santa Clara, CA, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050732687","display_name":"Charles Grumer","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Grumer, Charles","raw_affiliation_strings":["Infoblox, Santa Clara, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Infoblox, Santa Clara, CA, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049970022","display_name":"Femi Olumofin","orcid":null},"institutions":[{"id":"https://openalex.org/I4210150356","display_name":"University of Washington Tacoma","ror":"https://ror.org/05n8t2628","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701","https://openalex.org/I4210150356"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Olumofin, Femi","raw_affiliation_strings":["School of Engineering and Technology, University of Washington at Tacoma, Tacoma, WA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Engineering and Technology, University of Washington at Tacoma, Tacoma, WA, USA","institution_ids":["https://openalex.org/I4210150356"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5020586569","display_name":"Bin Yu","orcid":"https://orcid.org/0000-0002-1680-3129"},"institutions":[{"id":"https://openalex.org/I32597200","display_name":"Ghent University","ror":"https://ror.org/00cv9y106","country_code":"BE","type":"education","lineage":["https://openalex.org/I32597200"]}],"countries":["BE"],"is_corresponding":false,"raw_author_name":"Yu, Bin","raw_affiliation_strings":["Department of Applied Mathematics, Computer Science and Statistics, Ghent University, Ghent, Belgium"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Applied Mathematics, Computer Science and Statistics, Ghent University, Ghent, Belgium","institution_ids":["https://openalex.org/I32597200"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.4762,"has_fulltext":true,"cited_by_count":60,"citation_normalized_percentile":{"value":0.95506209,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8396948575973511},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.7044634222984314},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.703339159488678},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.6890910863876343},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6609641909599304},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.6402170062065125},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.5329903960227966},{"id":"https://openalex.org/keywords/simple","display_name":"Simple (philosophy)","score":0.47500765323638916},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and control","score":0.4405428469181061},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.4339165687561035},{"id":"https://openalex.org/keywords/domain-knowledge","display_name":"Domain knowledge","score":0.4132775664329529},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.13254067301750183}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8396948575973511},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.7044634222984314},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.703339159488678},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.6890910863876343},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6609641909599304},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.6402170062065125},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.5329903960227966},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.47500765323638916},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.4405428469181061},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4339165687561035},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.4132775664329529},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.13254067301750183},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"pmh:oai:digitalcommons.tacoma.uw.edu:tech_pub-1375","is_oa":false,"landing_page_url":"https://digitalcommons.tacoma.uw.edu/tech_pub/373","pdf_url":null,"source":{"id":"https://openalex.org/S4306400628","display_name":"University of Washington Tacoma Digital Commons (University of Washington Tacoma)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210150356","host_organization_name":"University of Washington Tacoma","host_organization_lineage":["https://openalex.org/I4210150356"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"School of Engineering and Technology Publications","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321730","display_name":"Fonds Wetenschappelijk Onderzoek","ror":"https://ror.org/03qtxy027"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":37,"referenced_works":["https://openalex.org/W3805906","https://openalex.org/W17316494","https://openalex.org/W1561983441","https://openalex.org/W1647671624","https://openalex.org/W1945616565","https://openalex.org/W1981294881","https://openalex.org/W2123845384","https://openalex.org/W2239778906","https://openalex.org/W2243397390","https://openalex.org/W2293768274","https://openalex.org/W2296452361","https://openalex.org/W2464432954","https://openalex.org/W2528572867","https://openalex.org/W2546910111","https://openalex.org/W2591788621","https://openalex.org/W2625935159","https://openalex.org/W2759618680","https://openalex.org/W2768793959","https://openalex.org/W2773671123","https://openalex.org/W2784291098","https://openalex.org/W2784815861","https://openalex.org/W2786906486","https://openalex.org/W2799194071","https://openalex.org/W2889547652","https://openalex.org/W2890928763","https://openalex.org/W2900892325","https://openalex.org/W2912464539","https://openalex.org/W2912761498","https://openalex.org/W2913694443","https://openalex.org/W2917948814","https://openalex.org/W2942650110","https://openalex.org/W4211122380","https://openalex.org/W4289306490","https://openalex.org/W4293846201","https://openalex.org/W4302282827","https://openalex.org/W4320013936","https://openalex.org/W4321320097"],"related_works":["https://openalex.org/W4380075502","https://openalex.org/W4223943233","https://openalex.org/W4312200629","https://openalex.org/W4360585206","https://openalex.org/W4364306694","https://openalex.org/W4281616679","https://openalex.org/W3211546796","https://openalex.org/W4223564025","https://openalex.org/W2968586400","https://openalex.org/W4312372161"],"abstract_inverted_index":{"Domain":[0],"generation":[1],"algorithms":[2],"(DGAs)":[3],"are":[4,64,133],"commonly":[5],"leveraged":[6],"by":[7,67],"malware":[8],"to":[9,34,136,148,191],"create":[10],"lists":[11],"of":[12,55,59,73,105,162,173],"domain":[13,38,61,145,167],"names,":[14],"which":[15,52],"can":[16],"be":[17],"used":[18],"for":[19,70],"command":[20],"and":[21,89,101,181],"control":[22],"(C&C)":[23],"purposes.":[24],"Approaches":[25],"based":[26,85],"on":[27,86,116,143],"machine":[28],"learning":[29,93],"have":[30],"recently":[31,78],"been":[32],"developed":[33],"automatically":[35],"detect":[36],"generated":[37],"names":[39,62],"in":[40],"real-time.":[41],"In":[42],"this":[43],"paper,":[44],"we":[45],"present":[46],"a":[47,121,150,153],"novel":[48],"DGA":[49,108,131,155,188],"called":[50],"CharBot,":[51],"is":[53,97,119,178],"capable":[54],"producing":[56],"large":[57],"numbers":[58],"unregistered":[60],"that":[63,112,130],"not":[65,120],"detected":[66],"state-of-the-art":[68],"classifiers":[69,115,132,189],"real-time":[71],"detection":[72],"the":[74,77,106,114,144,160,166,171,176,179],"DGAs,":[75],"including":[76],"published":[79],"methods":[80],"FANCI":[81],"(a":[82,91],"random":[83],"forest":[84],"human-engineered":[87],"features)":[88],"LSTM.MI":[90],"deep":[92],"approach).":[94],"The":[95],"CharBot":[96,117,177],"very":[98],"simple,":[99],"effective,":[100],"requires":[102],"no":[103],"knowledge":[104],"targeted":[107],"classifiers.":[109],"We":[110,125],"show":[111,129],"retraining":[113],"samples":[118],"viable":[122],"defense":[123],"strategy.":[124],"believe":[126],"these":[127],"findings":[128],"inherently":[134],"vulnerable":[135],"adversarial":[137,185],"attacks":[138],"if":[139],"they":[140],"rely":[141],"only":[142],"name":[146,168],"string":[147],"make":[149],"decision.":[151],"Designing":[152],"robust":[154],"classifier":[156],"may,":[157],"therefore,":[158],"necessitate":[159],"use":[161],"additional":[163],"information":[164],"besides":[165],"alone.":[169],"To":[170],"best":[172],"our":[174],"knowledge,":[175],"simplest":[180],"most":[182],"efficient":[183],"black-box":[184],"attack":[186],"against":[187],"proposed":[190],"date.":[192]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":12},{"year":2023,"cited_by_count":8},{"year":2022,"cited_by_count":7},{"year":2021,"cited_by_count":7},{"year":2020,"cited_by_count":11},{"year":2019,"cited_by_count":4}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2019-07-12T00:00:00"}