Malicious Domain Detection Based on Traffic Similarity

Abstract

Domain name system is an important resource in the Internet. Malicious domain detection techniques are used to find the malicious domains which are designed for malicious behaviors. The paper analyzes the existing malicious domain detection techniques and then proposes a new malicious domain detection technique based on traffic similarity. In this paper, we analyze the public botnet traffic dataset and get the DNS traffic pattern. We apply this pattern to spam as well. In this paper, we use normalized Fréchet distance to evaluate two traffic curves' similarity. Our experiments over simulation botnet and spam network show that the proposed technique can achieve high true positive rates (94.3% in average) as we change the botnet connection frequency, DGA types and spam sent rules. The proposed technique provides a new idea for malicious domain detection.

A Detection Scheme for DGA Domain Names Based on SVM

“…As shown in Table I, a normal domain name's length is generally shorter than 20, while the length of a DGA domain name is usually longer than that. The DGA domain names listed out in Table I, which are from the Banjiri malware [18], are only as an example in the paper. In fact, the length of some other DGA domain names may be even longer than the length of the names shown in Table I.…”