Abstract:Modern botnets such as Zeus and Conficker commonly utilize a technique called domain fluxing or a domain generation algorithm to generate a large number of pseudo-random domain names (PDNs) dynamically for botnet operators to control their bots. These botnets are becoming one of the most serious threats to Internet security on a global scale. How to prevent their destructive action is one of the most pressing issues of today. In this paper, we focus on detecting domain-flux botnets within the monitored network based on Domain Name System (DNS) traffic features. This method passively captures all DNS traffic from the gateway of a monitored network and then extracts key features to identify PDN. Based on examining and analyzing a large number of legitimate domains as well as PDN generated by botnets, we have discovered that there is a discernible bias in the rules for constructing domain names. Therefore, we introduce a methodology that analyzes DNS traffic to extract the length and the expected value, which can distinguish between a domain name generated by humans or bots. In order to evaluate the effectiveness of the proposed approach, various machine learning algorithms are applied to train predictive models for our detection system. This proposed scheme is implemented and tested in a real local area network. The experimental results show that our proposed method achieves the highest detective efficiency for decision tree algorithms (J48) with an average overall accuracy of up to 92.3% and a false positive rate of 4.8%. Copyright (c) 2016 John Wiley & Sons, Ltd.

Detecting Dga-Based Botnet with Dns Traffic Analysis in Monitored Network

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

Detecting Domain-Flux Botnet Based On Dns Traffic Features In Managed Network

Detecting bot-infected machines based on analyzing the similar periodic DNS queries

CNN-based DGA Detection with High Coverage

Detecting the DGA-Based Malicious Domain Names

Detecting Domain-Flux Malware Using Dns Failure Traffic

A Clustering Approach for Detecting Auto-generated Botnet Domains

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

BotDetector: a System for Identifying DGA-based Botnet with CNN-LSTM

Identifying Fast-Flux Botnet with AGD Names at the Upper DNS Hierarchy.

CCGA: Clustering and Capturing Group Activities for DGA-Based Botnets Detection

BotMeter: Charting DGA-Botnet Landscapes in Large Networks.

A Survey of Machine Learning and Deep Learning Based DGA Detection Techniques

Detecting Botnets By Analyzing Dns Traffic

Detecting Botnet Activities Based on Abnormal DNS traffic

Detecting Domain Flux Through Patterns of Domain Names’ Alphanumeric Characters and Querying Behavior of Hosts

Detection of DGA Domains Based on Support Vector Machine

Identifying bot infection using neural networks on DNS traffic

Botnet Detection Technology Based On Dns

Tracking and Characterizing Botnets Using Automatically Generated Domains