Scholarlink

<p>Botnets present a significant threat to the Internet, as they enable activities such as phishing, cryptojacking, financial fraud, and information theft. Modern botnets rely on the Domain Generation Algorithm (DGA) to avoid detection. They use DGA to create a large list of potential domains, from which bots select a small subset to connect to their command-and-control server. We propose DgaDetector, a system that provides continuous bot detection by analyzing DNS traffic. It combines DNS observations over time into a Hidden Markov Model. The transition probability in the model is derived from the number of non-existent domains resolved in the previous hour. We describe the design of DgaDetector and evaluate it using DNS traffic collected from a campus network over a period of six months. Our solution achieves an F1 score of 0.9967, outperforming other baselines, including DeepDAD. Its small runtime overhead makes it practical for real-time botnet detection.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

DgaDetector: Leveraging DNS Analysis for DGA-Based Bot Identification

  • 期刊论文

  • 发表日期：

    2026年5月11日

查看全文
  • Van Tong,
  • Hieu Mac,
  • Hung Pham,
  • Khanh Nguyen Quoc,
  • Tien Tuan Anh Dinh,
  • Duc Tran

摘要

Botnets present a significant threat to the Internet, as they enable activities such as phishing, cryptojacking, financial fraud, and information theft. Modern botnets rely on the Domain Generation Algorithm (DGA) to avoid detection. They use DGA to create a large list of potential domains, from which bots select a small subset to connect to their command-and-control server. We propose DgaDetector, a system that provides continuous bot detection by analyzing DNS traffic. It combines DNS observations over time into a Hidden Markov Model. The transition probability in the model is derived from the number of non-existent domains resolved in the previous hour. We describe the design of DgaDetector and evaluate it using DNS traffic collected from a campus network over a period of six months. Our solution achieves an F1 score of 0.9967, outperforming other baselines, including DeepDAD. Its small runtime overhead makes it practical for real-time botnet detection.