Source-linked AI summary
A Survey on Malicious Domains Detection through DNS Data Analysis
Yury Zhauniarovich, Issa Khalil, Ting Yu, Marc Dacier
TL;DR
Malicious domains support diverse Internet attacks, motivating detection through DNS behavior. This survey systematizes DNS-based detection research with a framework spanning data, analysis, and evaluation, and identifies unresolved challenges involving data access, validation, robustness, and scalability.
Problem
Existing malicious-domain detection approaches differ in their intuitions, data-analysis methods, and evaluation methodologies, requiring systematic comparison.
Method
The paper surveys prior work and categorizes it using DNS-data sources and enrichment, data-analysis methods, and evaluation strategies and metrics.
Results
The survey presents a general framework and systematization of research on detecting malicious domains through DNS data.
Takeaways & Limitations
The survey identifies major questions and challenges that should guide future DNS-based malicious-domain detection research.
Takeaways & Limitations
The field lacks publicly available reference datasets and extensive systematic experimental validation, hindering reproducible comparison of techniques.
Abstract
from arXiv · showhide
Malicious domains are one of the major resources required for adversaries to run attacks over the Internet. Due to the important role of the Domain Name System (DNS), extensive research has been conducted to identify malicious domains based on their unique behavior reflected in different phases of the life cycle of DNS queries and responses. Existing approaches differ significantly in terms of intuitions, data analysis methods as well as evaluation methodologies. This warrants a thorough systematization of the approaches and a careful review of the advantages and limitations of every group. In this paper, we perform such an analysis. In order to achieve this goal, we present the necessary background knowledge on DNS and malicious activities leveraging DNS. We describe a general framework of malicious domain detection techniques using DNS data. Applying this framework, we categorize existing approaches using several orthogonal viewpoints, namely (1) sources of DNS data and their enrichment, (2) data analysis methods, and (3) evaluation strategies and metrics. In each aspect, we discuss the important challenges that the research community should address in order to fully realize the power of DNS data analysis to fight against attacks leveraging malicious domains.
1 INTRODUCTION
The survey motivates DNS-based malicious-domain detection and organizes prior work through a general framework covering data sources, enrichment, algorithms, and evaluation.
- Motivation: DNS analysis is promising because DNS traffic is relatively small, feature-rich, and enrichable with information such as AS numbers and domain ownership.These properties support analysis at large scale and machine-learning applications.
- Scope and method: The survey reviews approaches for detecting domains involved in malicious activities through DNS-data analysis.The authors built a bibliography from four digital libraries, expert recommendations, and references extracted from collected papers.
- Framework: The proposed framework characterizes DNS-based detection techniques by data collection, enrichment, algorithm design, and evaluation-related components.It is intended to position and systematize the research that followed the field’s seminal 2005 work.
- Framework: DNS data may be collected at recursive or authoritative locations and at different granularities, with these choices affecting the behaviors visible to detection algorithms.The framework also considers enrichment from registration, autonomous-system, and geolocation data.
- Framework: The survey emphasizes sources, extracted features, analysis techniques, and evaluation strategies as central dimensions for comparing existing approaches.These dimensions form the core of the survey’s later sections.
2 DOMAIN NAME SYSTEM BACKGROUND
The paper introduces DNS as a hierarchical naming system and explains how its operation and permitted uses create both observability opportunities and security threats. It focuses on malicious activities that exploit DNS legitimately while leaving detectable traces in DNS data.
- DNS operation: DNS decouples a service’s physical IP address from its logical domain name through a hierarchical, decentralized naming system.Clients can reach services using domain names rather than memorizing IP addresses.
- DNS operation: Domain names form a suffix tree whose labels define hierarchy, with the rightmost label representing the Top Level Domain.Fully qualified domain names identify nodes associated with resource records.
- DNS operation: Resolvers process client requests recursively and, through caching, are the only components with a complete view of how many clients resolve a given domain.When an answer is absent from cache, the resolver searches for the authoritative name server.
- DNS security: DNS security threats include attacks on DNS infrastructure, manipulation of DNS-provided data, and malicious use of DNS by malware and botnets.Examples include denial-of-service, hijacking, poisoning, command-and-control, data exfiltration, and payload distribution.
- DNS security: The survey focuses on attacks that leverage DNS genuinely, because changing domain-IP mappings improves malware-server mobility while leaving traces in DNS data.Those traces provide clues for detecting domains involved in such malicious activities.
3 DATA SOURCES DEFINITIONS
The survey organizes DNS data sources by collection location and active or passive collection, emphasizing that these choices shape observable behavior and detection assumptions. It also highlights limited access, sharing barriers, and generalization challenges.
- Collection dimensions: DNS data sources differ by collection location and collection mode, with both dimensions shaping detection assumptions.The survey distinguishes where data is collected from how it is collected.
- Where data is collected: Host-Resolver data exposes client-to-resolver queries and supports host behavior analysis, while DNS-DNS data offers broader organizational visibility but is affected by caching.Resolver data is easier for organizations to access, whereas non-resolver logs are harder to obtain.
- How data is collected: Active collection deliberately resolves selected domains, whereas passive collection observes real DNS requests and can provide richer, more representative behavior statistics.Passive collection does not require an initial domain list and can reveal aggregate query surges unavailable from active collection.
- Challenges: Small or local datasets may not support methods designed for big-data settings, while combining DNS logs across organizations faces legal and bureaucratic obstacles.These constraints limit the breadth of observed threats and access to public or ISP data.
- Challenges: Sensitive DNS data is difficult to share, leaving the field with limited systematic validation and few common reference datasets.Available public datasets often cannot support approaches requiring client-side patterns.
- Challenges: Results may not generalize across datasets because space- or time-specific properties can substantially influence detection performance.The survey therefore stresses validation across varied datasets and conditions.
4 DESIGN OF DETECTION ALGORITHMS
The survey presents detection approaches through three orthogonal viewpoints: their features, underlying methods, and produced outcomes. This structure organizes the state of the art and the examples summarized in the paper.
- Classification viewpoints: The survey categorizes detection approaches by the features they use, the technology underlying the method, and the outcome they produce.These viewpoints are treated separately in the following subsections.
- Overview: Table 2 summarizes the design-of-algorithms section by listing representative examples and related articles.The table is an overview rather than an exhaustive inventory.
4.1 Features
The survey treats feature engineering as central to detection quality and organizes features along three dimensions: internal versus contextual, dataset-dependent versus independent, and mono-domain versus multi-domain.
- Feature extraction: Feature engineering strongly affects detection accuracy and robustness, but predictive features may be vulnerable when attackers can forge them.Poor features can undermine otherwise effective detection algorithms.
- Feature taxonomy: The survey abstracts feature construction into internal/contextual, DNS dataset dependent/independent, and mono/multi-domain dimensions.Raw DNS values may be statistically transformed, enriched externally, or represented as graphs.
- Internal vs. contextual: Internal features use DNS records alone, whereas contextual features combine DNS information with external sources such as IP-to-AS mappings or web presence.Some contextual features require querying resources controlled by attackers.
- Internal vs. contextual: Internal features are simpler but may miss important signals such as domain registration time, whose availability is limited for many ccTLDs.Registration patterns can support proactive detection, but registry and WHOIS access constraints restrict applicability.
- Dataset dependence: DNS dataset-dependent features require cross-dataset validation, while dataset-independent features are more stable across environments.Observed IP counts and domain associations depend on the dataset; search-engine hit counts and n-grams do not.
- Mono vs. multi-domain: Mono-domain features can operate on completely different datasets, whereas multi-domain association methods usually require larger datasets.Multi-domain approaches include graph-based and clustering methods based on domain relationships.
4.2 Detection Methods
The survey groups detection methods into knowledge-based, machine-learning-based, and hybrid approaches. It emphasizes trade-offs involving expert bias, labeled-data requirements, algorithm design difficulty, and multi-stage combinations.
- Knowledge-based methods: Knowledge-based methods encode expert insights and heuristics derived from observed anomalies in malicious-domain activity.Measurement studies can identify behaviors such as simultaneous querying of domains from one malware family.
- Hybrid approaches: Hybrid approaches pass outputs between multiple detection methods, combining machine-learning and knowledge-based techniques in multi-stage systems.Notos is described as an example that combines classifiers, heuristics, and host-domain graph processing.
- Knowledge-based methods: Knowledge-based approaches can be biased because their assumptions and thresholds depend on expert-selected characteristics.Adversarial behavior can change, degrading approaches built on earlier observations.
- Machine learning: Machine-learning approaches dominate the surveyed literature and include supervised, semi-supervised, and unsupervised learning.The survey lists these three categories as its main machine-learning subdivisions.
- Supervised learning: Supervised learning is popular because it is straightforward and can automatically select relevant features, but it requires labeled domains that are difficult to obtain completely and correctly.In practice, training data are often trimmed to high-confidence labels, leaving most samples unlabeled.
- Semi-supervised learning: Semi-supervised learning combines labeled and unlabeled data, using the latter to adjust hypotheses derived from labeled examples.Graph-based inference and cluster-and-label methods are prominent examples in this category.
- Unsupervised learning: Unsupervised methods avoid dependence on labeled datasets by clustering domains using internal data properties, but they are difficult to design and therefore less common.Researchers often prefer supervised or semi-supervised methods because labeled datasets, although imperfect, are available.
4.3 Outcome
The survey distinguishes malicious-domain detection approaches by whether they are agnostic to malicious behavior or target specific behaviors, while some combine features for multiple activities.
- Behavior-agnostic approaches infer maliciousness from associations with domains in the ground truth, sometimes called “guilty by association.”
- Behavior-specific approaches capture features associated with particular activities, including lexical or resolution features for automatically generated domain names.
- Some approaches combine domain-name features for DGAs with DNS-answer features such as distinct IP counts and TTL values for IP fluxing.
4.4 Challenges
The survey identifies challenges involving feature robustness, operational performance and latency, adaptation to changing adversaries, evaluation comparability, and ambiguity about malicious behavior.
- Feature Related Challenges: Features must separate benign from malicious domains while resisting manipulation, because attackers can change DGA parameters to invalidate recognizable-name features.Resource-capacity features are more robust when forging them would reduce the attacker’s gain.
- Feature Related Challenges: A systematic framework for quantitatively evaluating feature robustness remains unavailable and should account for forging complexity and effects on attack utility.
- Detection Methods Related Challenges: Real-world DNS volumes can exceed publication datasets, so detection methods require performance and scalability analysis; filtering low-frequency domains may omit malicious ones.
- Detection Methods Related Challenges: Batch or aggregate methods may delay decisions until enough DNS requests arrive, reducing effectiveness against short-lived domains; 63% of phishing campaigns lasted under two hours.
- Detection Methods Related Challenges: Adaptive adversaries require detection techniques to retrain and adapt, because models can become obsolete as attacker behavior changes.
- Detection Methods Related Challenges: The field lacks a systematic, reproducible, quantitative basis for comparing detection methods’ effectiveness and efficiency.
- Detection Methods Related Challenges: Maliciousness is not uniformly defined: domains may support spam, malware distribution, or other activities, and some approaches cannot explain their decisions.
5 EVALUATION METHODS
The survey reviews machine-learning evaluation metrics and validation strategies for DNS-based detection, then highlights problems with validating new knowledge, benchmarking, metric calculation, and deployment realism.
- DNS-based approaches commonly borrow machine-learning evaluation strategies, but adaptive attackers require evaluation strategies that can account for changing behavior.
- Recall measures correctly identified malicious domains, while false-positive rate measures benign domains incorrectly flagged as malicious.Recall is TPR = TP/P; FPR = FP/N.
- False-negative rate and precision respectively measure missed malicious domains and the proportion of flagged domains that are correctly malicious.FNR = FN/P; precision = TP/(TP + FP).
- Increasing TPR can also increase FPR, so accuracy is assessed through discrimination thresholds reflecting their dependency.
- Customized metrics capture system-specific properties such as expansion, blacklist completeness, and delay after domain registration.
- Cross-validation and train-test splits are widely used, including a reported 70% training and 30% testing partition.
- Standard validation can misrepresent deployment behavior because traffic profiles differ across organizations and geographic settings.
- Challenges: Newly predicted domains are difficult to validate: blacklists are incomplete, manual inspection is costly and unreliable, and automated checks can be evaded or miss targeted services.
6 CONCLUSION
The survey systematizes DNS-based malicious-domain detection across data sources, analysis techniques, and evaluation methods. It identifies major data, ground-truth, and robustness challenges that constrain progress and motivate future research.
- The survey organizes detection design around DNS, ground-truth, and auxiliary data; feature and analysis choices; and evaluation strategies, metrics, robustness, and deployment context.
- Large-scale DNS logs are rarely public, sharing faces legal, privacy, and bureaucratic obstacles, and the community lacks an agreed method for building ground truth from noisy intelligence.
- The survey aims to support future research and development of methods and applications addressing attacks that leverage malicious domains.