Real-time bot infection detection system using DNS fingerprinting and machine-learning

• Published in: Computer networks (Amsterdam, Netherlands : 1999) Netherlands : 1999), 2023-06, Vol.228, p.109725, Article 109725
• Main Authors: Quezada, Vicente, Astudillo-Salinas, Fabian, Tello-Oquendo, Luis, Bernal, Paul
• Format: Article
• Language: English
• Subjects: Anomaly detection; Bot detection; Botnet; DNS-based bot detection; ELK stack; Isolation forests; Machine learning; Random forests
• ISSN: 1389-1286; 1872-7069
• DOI: 10.1016/j.comnet.2023.109725

In today’s cyberattacks, botnets are used as an advanced technique to generate sophisticated and coordinated attacks. Infected systems connect to a command and control (C&C) server to receive commands and attack. Thus, detecting infected hosts makes it possible to protect the network’s resources and prevent them from illicit activities toward third parties. This research elaborates on the design, implementation, and results of a bot infection detection system based on Domain Name System (DNS) traffic events for a network corporation. An infection detection feasibility analysis is performed by creating fingerprints. The traces are generated from a numerical analysis of 13 attributes. These attributes are obtained from the DNS logs of a DNS server. It looks for fingerprint anomalies using Isolation Forest to label a host as infected or not. In addition, on the traces cataloged as anomalous, a search will be carried out for queries to domains generated by Domain Generation Algorithms (DGA). Then, Random Forest generates a model that detects future bot infections on hosts. The devised system integrates the ELK stack and Python. This integration facilitates the management, transformation, and storage of events, generation of fingerprints, machine learning application, and analysis of fingerprint classification results with a precision greater than 99%.