A Novel Approach for Detecting DGA-Based Botnets in DNS Queries Using Machine Learning Techniques

Abstract

In today’s security landscape, advanced threats are becoming increasingly difficult to detect as the pattern of attacks expands. Classical approaches that rely heavily on static matching, such as blacklisting or regular expression patterns, may be limited in flexibility or uncertainty in detecting malicious data in system data. This is where machine learning techniques can show their value and provide new insights and higher detection rates. The behavior of botnets that use domain-flux techniques to hide command and control channels was investigated in this research. The machine learning algorithm and text mining used to analyze the network DNS protocol and identify botnets were also described. For this purpose, extracted and labeled domain name datasets containing healthy and infected DGA botnet data were used. Data preprocessing techniques based on a text-mining approach were applied to explore domain name strings with n-gram analysis and PCA. Its performance is improved by extracting statistical features by principal component analysis. The performance of the proposed model has been evaluated using different classifiers of machine learning algorithms such as decision tree, support vector machine, random forest, and logistic regression. Experimental results show that the random forest algorithm can be used effectively in botnet detection and has the best botnet detection accuracy.

A Deep learning framework for domain generation algorithm based malware detection

“…A sample from the gathered dataset is given in figure 3. They have two fields: Scheme Technique Disadvantage [14] Machine learning Performance Issues on large datasets [25] TFIDF models are used for detection.…”

“…Any machine learning algorithm clearly necessitates an effective feature engineering process, and the features may also need to be changed. [25] proposed a method to extract network behaviour patterns, analyses user behaviour and records the quantity of traffic exchanged between sites. Term frequency-inverse document frequency (TFIDF) models are used to create a system for recognising behavioural patterns, and principal component analysis (PCA) is utilised to improve the speed and accuracy of diagnosis evaluation results.…”

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

“…After the progressions, they use Graph Structure Based Detection of Anomaly (GSBDA) to detect hazardous anomalies and lastly use a KNN to identify the botnet accurately. Ali and Fatemeh [151] uses DNS queries to extract features from network traffic and then apply ML to generate a botnet detection report. Their studies included testing DT, SVM, RF and Logical regression as their ML algorithms and obtained accuracies of 98%, 96%, 99% and 93% respectively.…”

Enhanced DGA Detection in BotNet Traffic: Leveraging N-Gram, Topic Modeling and Attention BiLSTM

“…Periodically, they can also update their control system about their working status. The method by which the botmaster provides instructions and code updates to bots is known as a "botnet control system," also known as a "command and control server" (Soleymani & Arabgol, 2021). Botnet architectures frequently employ Domain Generation Algorithms (DGAs) to avoid detection and shutdown attempts.…”