Detecting Botnets from Dns Query Data Using Machine Learning
Odonchimeg Lkhagva*, Bulganmaa Togookhuu and Bilguunt Sogtsaran
Abstract
In recent years, botnets have emerged as a significant cybersecurity threat, making detection increasingly complex. Botnets serve as powerful tools for cybercriminals to conduct cyberattacks such as Distributed Denial of Service (DDoS), phishing, and data theft. Therefore, implementing Domain Name System (DNS)-based detection methods to address the botnet problem has emerged as a critical research direction. DNS plays a vital role in mapping domain names to IP addresses and maintaining continuous network traffic management. Botnets exploit this system to hide their operations, leveraging techniques such as dynamic DNS (DDNS), domain generation algorithms (DGA), and fast-flux, which frequently alter domain information to evade detection.
This study delves into DNS functionality and its use in detecting botnets, aiming to enhance protection against attacks. By utilizing machine learning to detect botnets from DNS query data, the research improves the ability to identify cyber threats at an early stage. This provides a novel solution in the cybersecurity field, contributing to proactive defense against cybercriminal activities. The Random Forest machine learning method was employed to detect botnets, achieving an accuracy of over 97%, outperforming traditional methods. However, the detection process faced challenges when some botnets used domain names structurally similar to legitimate ones. To address this, the research introduces a new feature called the Consonant-Vowel Ratio (CVR) as the 25th feature to better identify domains generated by DGAs. The CVR reflects linguistic characteristics commonly observed in DGA-generated domain names, such as a lack of phonetic and structural regularity. The study demonstrates that legitimate domain names maintain consonant-vowel harmony for readability, whereas DGA-generated domains tend to include an excessive number of consonants to evade detection models and blacklists. The findings highlight the effectiveness of CVR in improving detection performance against such botnet strategies.
