XGBoost Applied to Identify Malicious Domains Using Passive DNS

• Autor(a) principal: Silveira, Marcos Rogerio [UNESP]
• Data de Publicação: 2020
• Outros Autores: Silva, Leandro Marcos da [UNESP], Cansian, Adriano Mauro [UNESP], Kobayashi, Hugo Koji, GkoulalasDivanis, A., Marchetti, M., Avresky, D. R.
• Tipo de documento: Artigo de conferência
• Idioma: eng
• Título da fonte: Repositório Institucional da UNESP
• Texto Completo: http://hdl.handle.net/11449/218874
• topic: Domain Name System; malicious domain; passive DNS; machine learning

The Domain Name System (DNS) is an essential component for the Internet, as its main function is to map the domain name to Internet Protocol addresses, in which the hosts respond. Because of its importance, attackers use this tool for malicious purposes such as spreading malware, botnets, fast-flux domains, and Domain Generation Algorithms (DGAs). In this paper, we present an approach to automatically detect malicious domains using passive DNS, using the supervised machine learning algorithm Extreme Gradient Boosting (XGBoost). We use 12 features extracted exclusively from DNS traffic. The model's evaluation proved its effectiveness with an average AUC of 0.9763.