Abstract:Malicious domains pose a severe threat to cybersecurity. As to improve the detection accuracy when the malicious domain variants increase, we proposed a novel malicious domain detection method named MDND‐SS‐PO that combines semi‐supervised learning and parameter optimization. The method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. And an improved DBSCAN based on the neighborhood division is applied semi‐supervised learning with less label efforts. Finally, Gaussian process regression is used to optimize parameter settings of machine learning algorithms. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%. Malicious domains provide malware with covert communication channels which poses a severe threat to cybersecurity. Despite the continuous progress in detecting malicious domains with various machine learning algorithms, maintaining up‐to‐date various samples with fine‐labeled data for training is difficult. To handle these issues and improve the detection accuracy, a novel malicious domain detection method named MDND‐SS‐PO is proposed that combines semi‐supervised learning and parameter optimization. The contributions of the study are as follows. First, the method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. Second, an improved DBSCAN based on the neighborhood division is designed to cluster labeled data and unlabeled data with low time consumption. Then, based on the clustering hypothesis, unlabeled data is tagged with pseudo‐label according to the cluster results, which aims to train a supervised classifier effectively. Finally, Gaussian process regression is used to optimize parameter settings of the algorithm. And the Silhouette index and F1 score are introduced to evaluate the optimization results. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%.

Malicious Domain Name Detection Based on Extreme Machine Learning

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

Malware Analysis Using Machine Learning and Deep Learning Techniques

A Novel Intrusion Detection System Based on an Optimal Hybrid Kernel Extreme Learning Machine

Towards a Deep Learning Approach for Detecting Malicious Domains

A New Malware Detection System Using a High Performance-ELM method

Malicious domain detection based on multiple-dimensional features

A Malicious Domain Detection Model Based on Improved Deep Learning

Identifying Malicious Web Domains Using Machine Learning Techniques with Online Credibility and Performance Data.

Detection of Malicious Domain Names Based on Hidden Markov Model

Identifying APT Malware Domain Based on Mobile DNS Logging

Network Detection of Malicious Domain Name Based on Adversary Model

Malicious domain detection based on semi‐supervised learning and parameter optimization

Analysis of Extreme Learning Machines (ELMs) for intelligent intrusion detection systems: A survey

Detection of Malicious Software by Analyzing Distinct Artifacts Using Machine Learning and Deep Learning Algorithms

Detecting Malicious Domains with Behavioral Modeling and Graph Embedding

An Overview of Advanced Persistent Threat Detection Based on Machine Learning

An Intrusion Detection Model Using Extreme Learning Machine

AULD: Large Scale Suspicious DNS Activities Detection Via Unsupervised Learning in Advanced Persistent Threats.

A Comprehensive Review of Machine Learning Approaches for Detecting Malicious Software

MalHunter: Performing a Timely Detection on Malicious Domains Via a Single DNS Query.