Date of Publication :7th September 2016

Abstract: The Domain Name System (DNS) is an integral component of the internet which efficiently converts domain names into 32 bit IP addresses and vice versa. The internet had always been a favorite target where the attackers staged various types of malicious activities with their effects ranging from small to extreme. The attackers are now a days focusing on attacking domains which involves managing botnet to fire numerous attacks on the victim. Relative to the increase in the number of wicked web users targeting domains for implementing malicious activity there is also an increase in the number of scholars interested in doing research to curb the advancement of such attacks. Many systems have already been introduced various researchers to detect domains involved in malicious activities based on the DNS query and response observation of the domain under consideration. Some of the systems thus developed blacklist those domains that are fraudulent in nature. We propose a machine learning approach in detecting malicious domain names by assigning scores to the domains based on the analysis. The attributes relevant for our experiment that distinguish malicious and benign domains were obtained by analyzing a large number of features from collected DNS query responses. In addition to the features based on domain names we also make use of the Google Page Rank, Alexa Traffic Rank and SSL rating. We assign score to each domain in the range of 0 to 10. Based on the experimental results and observations a low score below and including 5 implies that the domain is involved in malicious activities and scores above 5 implies benign domain.

Reference :