Detecting Malicious Domains: A Review

Samar Abbas Mangi; Samina Rajper; Noor Ahmed Shaikh; Nizamuddin Maitlo; Asad Hameed Soomro; Waseem Ahmed Buriro

Author(s)

Samar Abbas Mangi Shah Abdul Latif University Khairpur, Pakistan

Samina Rajper Shah Abdul Latif University Khairpur, Pakistan

Noor Ahmed Shaikh Shah Abdul Latif University Khairpur, Pakistan

Nizamuddin Maitlo IBA – Institiue of Emerging Technologies Khairpur, Pakistan

Asad Hameed Soomro Shah Abdul Latif University Khairpur, Pakistan

Waseem Ahmed Buriro Sukkur IBA University Country, Pakistan

Abstract

Malicious domain names are an important and worrying indicator of cyberattacks and can pose serious risks to your privacy and property. Unwary Internet users can obtain malicious services from these domains, including spam servers, phishing sites, and command and control (C&C) servers. Therefore, developing efficient algorithms to identify tumor regions has attracted much attention and interest. Data sources and implementation strategies used by current detection technologies vary widely. In this study, we performed a comprehensive retrospective analysis of these methods and divided the data into Domain Name System (DNS) data and DGA data. Researchers must use appropriate detection techniques that match the unique characteristics of the data, because different data sources provide different data models and carry different information. Therefore, the detection method is divided into four types. For each method, we describe a general detection framework that defines the main steps and processes involved. In addition, we provide insight into the future potential of research on malicious domain detection. By examining existing methods for detecting and identifying vulnerabilities, this document contributes to the fight against the ever-changing threat of malicious domains, ultimately improving the security of Internet users worldwide.

Publication Details

Page(s) 31-37

DOI DOI not available

Published Journal: Journal of Information & Communication Technology (JICT), Volume: 18, Issue: 2, Year: 2024

Request the full text from PASTIC

Keywords

detection technologies, Domain Name System., cyberattacks, Malicious domain, efficient algorithms, phishing sites

References

Rice T.,Kim D. W.,Yang M. .2023 .. , : .

. .Developing a GUI Application: GPU-Accelerated Malicious Domain Detection. In Proceedings of the 2023 ACM Southeast Conference, : 167-171.

Hussain K.,Baryalai A.,M. A. .2023 .A Unified Learning Approach for Malicious Domain Name Detection. , 12(5) : 458.

Luo H.,Liu W.,Cao Q. .2023 .(Vol. In Second International Symposium on Computer Applications and Information Systems (ISCAIS, 12721 : 53-61.

Khalil I. M.,Guan B.,Nabeel M.,Yu T. .2018 .A Domain is only as Good as its Buddies. In Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy, : .

Rahbarinia B.,Perdisci R.,Antonakakis M. .2015 .Efficient behavior-based tracking of malware-control domains in large ISP networks. In 2015 45th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, : 403-414.

Antonakakis M.,Perdisci R.,Nadji Y.,Vasiloglou N.,Abu-Nimeh S.,Lee W.,Dagon D. .2012 .From {Throw-Away} traffic to bots: Detecting the rise of {DGA-Based} malware. In 21st USENIX Security Symposium (USENIX Security 12), : 491-506.

Zdrnja B.,Brownlee N.,Wessels D. .2007 .Passive monitoring of DNS anomalies. In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, : .

. .. , : 139.

Antonakakis M.,Perdisci R.,Dagon D.,Lee W.,Feamster N. .2010 .Building a dynamic reputation system for {DNS}. In 19th USENIX Security Symposium (USENIX Security 10)., : .

Antonakakis M.,Perdisci R.,Lee W.,Vasiloglou II,Dagon D. .2011 .Detecting malware domains at the upper {DNS} hierarchy. In 20th USENIX Security Symposium (USENIX Security 11)., : .

. .Using passive dns to detect malicious domain name. In Proceedings of the 3rd International Conference on Vision, Image and Signal Processing, : 1-8.

.2019 .(pp. In 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID, : 399-412.

Sun X.,Yang J.,Wang Z.,Liu H. .2020 .HGDom: heterogeneous graph convolutional networks for malicious domain detection. In NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium, : 1-9.

.2009 .Your botnet is my botnet: analysis of a botnet takeover. In Proceedings of the 16th ACM conference on Computer and communications security, : 635-647.

Ghalati N. F.,Ghalaty N. F.,Barata J. .2020 .. , : .

.2020 .Towards the detection of malicious URL and domain names using machine learning. Portugal, July 1-3, 11 : 109-117.

Zhu J.,Zou F. .2019 .Detecting malicious domains using modified SVM model. In 2019 IEEE 21st International Conference on High Performance Computing and Communications; IEEE 17th International Conference on Smart City; IEEE 5th International Conference on Data Science and Systems, : 492-499.

Wang Q.,Li L.,Jiang B.,Lu Z.,Liu J.,Jian S.,Part II S. .2020 .Malicious domain detection based on kmeans and smote. In Computational Science-ICCS, : 468-481.

Vinayakumar R.,Soman K. P.,Poornachandran P. .2018 .Detecting malicious domain names using deep learning approaches at scale. Journal of Intelligent & Fuzzy Systems, 34(3) : 1355-1367.

Chen Y.,Zhang S.,Liu J.,Li B. .2018 .Towards a deep learning approach for detecting malicious domains. In 2018 IEEE International Conference on Smart Cloud (SmartCloud), : 190-195.

Sun Y.,Chong N. S.,Ochiai H. .2020 .. , : .

. .Text-based malicious domain names detection based on variational autoencoder and supervised learning. In 2020 54th Annual Conference on Information Sciences and Systems (CISS), : 1-5.

Xu C.,Shen J.,Du X. .2019 .Detection method of domain names generated by DGAs based on semantic representation and deep neural network. Computers & Security, 85 : 77-88.

He W.,Gou G.,Kang C.,Liu C.,Li Z.,Xiong G. .2019 .Malicious domain detection via domain relationship and graph models. In 2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC), : 1-8.

Cersosimo M.,Lara A. .2022 .Detecting malicious domains using the splunk machine learning toolkit. In NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium, : 1-6.

Park K. H.,Song H. M.,Yoo Do,Hong J.,Cho S. Y.,Kim B.,Kim K.,H. K. K. .2022 .Unsupervised malicious domain detection with less labeling effort. Computers & Security, 116 : 102662.

Atrees M.,Ahmad A.,Alghanim F. .2022 .. , : .

Features Lexical . .Enhancing Detection of Malicious URLs Using Boosting. Intelligent Automation & Soft Computing, 31(3) : .

Darwish S. M.,Anber A. E.,Mesbah S. .2021 .. , : .

. .Bio-inspired machine learning mechanism for detecting malicious URL through passive DNS in big data platform. Machine Learning and Big Data Analytics Paradigms: Analysis, Applications and Challenges, 147 : 161.

Silveira M. R.,Silva L. M.,Cansian A. M.,Kobayashi H. K. .2021 .Detection of newly registered malicious domains through passive DNS. In 2021 IEEE International Conference on Big Data (Big Data), : 3360-3369.

Deshpande A.,Pedamkar O.,Chaudhary N.,Borde S. .2021 .Detection of phishing websites using Machine Learning. International Journal of Engineering Research & Technology (IJERT), 10(05) : .