# Open SESAME: Fighting Botnets with Seed Reconstructions of Domain Generation Algorithms

arXiv: https://arxiv.org/abs/2301.05048 · HTML: https://mlsanity.com/paper/2301.05048/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 39 references that are in the map.
- First posted on arXiv 12 Jan 2023.

## Builds on (most cited first, 6 of 6)

- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://mlsanity.com/paper/1806.01156/) (2018)
- [Predicting Domain Generation Algorithms with Long Short-Term Memory Networks](https://mlsanity.com/paper/1611.00791/) (2016)
- [Analyzing the Real-World Applicability of DGA Classifiers](https://mlsanity.com/paper/2006.11103/) (2020)
- [Making Use of NXt to Nothing: The Effect of Class Imbalances on DGA Detection Classifiers](https://mlsanity.com/paper/2007.00300/) (2020)
- [Inline Detection of Domain Generation Algorithms with Context-Sensitive Word Embeddings](https://mlsanity.com/paper/1811.08705/) (2018)
- [Tracking and Characterizing Botnets Using Automatically Generated Domains](https://mlsanity.com/paper/1311.5612/) (2013)

## Abstract (arXiv)

An important aspect of many botnets is their capability to generate pseudorandom domain names using Domain Generation Algorithms (DGAs). A cyber criminal can register such domains to establish periodically changing rendezvous points with the bots. DGAs make use of seeds to generate sets of domains. Seeds can easily be changed in order to generate entirely new groups of domains while using the same underlying algorithm. While this requires very little manual effort for an adversary, security specialists typically have to manually reverse engineer new malware strains to reconstruct the seeds. Only when the seed and DGA are known, past and future domains can be generated, efficiently attributed, blocked, sinkholed or used for a take-down. Common counters in the literature consist of databases or Machine Learning (ML) based detectors to keep track of past and future domains of known DGAs and to identify DGA-generated domain names, respectively. However, database based approaches can not detect domains generated by new DGAs, and ML approaches can not generate future domain names. In this paper, we introduce SESAME, a system that combines the two above-mentioned approaches and contains a module for automatic Seed Reconstruction, which is, to our knowledge, the first of its kind. It is used to automatically classify domain names, rate their novelty, and determine the seeds of the underlying DGAs. SESAME consists of multiple DGA-specific Seed Reconstructors and is designed to work purely based on domain names, as they are easily obtainable from observing the network traffic. We evaluated our approach on 20.8 gigabytes of DNS-lookups. Thereby, we identified 17 DGAs, of which 4 were entirely new to us.