UMUDGA: A dataset for profiling algorithmically generated domain names in botnet detection

Mattia Zago; Manuel Gil Pérez; Gregorio Martínez Pérez

doi:10.1016/j.dib.2020.105400

UMUDGA: A dataset for profiling algorithmically generated domain names in botnet detection

Data Brief. 2020 Mar 9:30:105400. doi: 10.1016/j.dib.2020.105400. eCollection 2020 Jun.

Authors

Mattia Zago¹, Manuel Gil Pérez¹, Gregorio Martínez Pérez¹

Affiliation

¹ Department of Information Engineering and Communications, University of Murcia, Campus Espinardo Murcia 30100 Spain.

Abstract

In computer security, botnets still represent a significant cyber threat. Concealing techniques such as the dynamic addressing and the domain generation algorithms (DGAs) require an improved and more effective detection process. To this extent, this data descriptor presents a collection of over 30 million manually-labeled algorithmically generated domain names decorated with a feature set ready-to-use for machine learning (ML) analysis. This proposed dataset has been co-submitted with the research article "UMUDGA: a dataset for profiling DGA-based botnet" [1], and it aims to enable researchers to move forward the data collection, organization, and pre-processing phases, eventually enabling them to focus on the analysis and the production of ML-powered solutions for network intrusion detection. In this research, we selected 50 among the most notorious malware variants to be as exhaustive as possible. Inhere, each family is available both as a list of domains (generated by executing the malware DGAs in a controlled environment with fixed parameters) and as a collection of features (generated by extracting a combination of statistical and natural language processing metrics).

Keywords: Data; Domain Generation Algorithm (DGA); Machine learning; Natural Language Processing (NLP); Network security.