Abstract:Malicious domains pose a severe threat to cybersecurity. As to improve the detection accuracy when the malicious domain variants increase, we proposed a novel malicious domain detection method named MDND‐SS‐PO that combines semi‐supervised learning and parameter optimization. The method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. And an improved DBSCAN based on the neighborhood division is applied semi‐supervised learning with less label efforts. Finally, Gaussian process regression is used to optimize parameter settings of machine learning algorithms. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%. Malicious domains provide malware with covert communication channels which poses a severe threat to cybersecurity. Despite the continuous progress in detecting malicious domains with various machine learning algorithms, maintaining up‐to‐date various samples with fine‐labeled data for training is difficult. To handle these issues and improve the detection accuracy, a novel malicious domain detection method named MDND‐SS‐PO is proposed that combines semi‐supervised learning and parameter optimization. The contributions of the study are as follows. First, the method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. Second, an improved DBSCAN based on the neighborhood division is designed to cluster labeled data and unlabeled data with low time consumption. Then, based on the clustering hypothesis, unlabeled data is tagged with pseudo‐label according to the cluster results, which aims to train a supervised classifier effectively. Finally, Gaussian process regression is used to optimize parameter settings of the algorithm. And the Silhouette index and F1 score are introduced to evaluate the optimization results. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%.

DNSRadar: Outsourcing Malicious Domain Detection Based on Distributed Cache-Footprints

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

Reexamining DNS from a Global Recursive Resolver Perspective

Deepdom: Malicious Domain Detection with Scalable and Heterogeneous Graph Convolutional Networks

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

Accurate DNS query characteristics estimation via active probing.

A Practical Machine Learning-Based Framework to Detect DNS Covert Communication in Enterprises

A Survey on Malicious Domains Detection through DNS Data Analysis

HGDom: Heterogeneous Graph Convolutional Networks for Malicious Domain Detection

DNSScope: Fine-Grained DNS Cache Probing for Remote Network Activity Characterization

BotMeter: Charting DGA-Botnet Landscapes in Large Networks.

DAmpADF: A framework for DNS amplification attack defense based on Bloom filters and NAmpKeeper

Malicious domain detection based on semi‐supervised learning and parameter optimization

Countering Malicious Processes with Process-DNS Association.

Wolf in Sheep's Clothing: Evaluating Security Risks of the Undelegated Record on DNS Hosting Services

A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach

Can We Learn What People Are Doing from Raw DNS Queries?

Information-Based Heavy Hitters for Real-Time DNS Data Exfiltration Detection and Prevention

D3N: DGA Detection with Deep-Learning Through NXDomain

An Analysis of the Domain Names Linked to the Important World Events using a Longitudinal Measurement Approach

Monitoring Security of Enterprise Hosts via DNS Data Analysis