Domain names are the unique names that identify Internet resources. Attackers use malicious domains to host drive-by-download malware, botnets, phishing websites, and spam emails. Such attacks can cause significant financial losses for large corporations. Detecting such threats in a timely manner is critical to disrupting them. Traditionally, vetting of domains has relied on blacklists to flag malicious domains, but these are often not up-to-date and are limited in scope.
More recently, researchers have developed ML-based methods to improve malicious domain detection. They build a model to discover associations between malicious domains and malicious activities using data from passive DNS traffic. They then utilize this model to detect malicious domains in real time while a user is browsing the web. Such models are often implemented as browser extension, making them more widely accessible to users and easier to integrate into existing web applications.
Detecting Malicious Domains: Strategies and Tools
While such ML-based approaches offer an excellent starting point, they suffer from several limitations, including low accuracy, precision, and recall and poor model inference performance. Moreover, they are computationally expensive and require substantial data processing.
Hence, the goal of this work is to develop a more efficient and accurate malicious domain detection method, capable of being integrated into web browsers for real-time detection. To this end, we design and implement an ML-based domain detection algorithm called MADONNA that incorporates text-based features, DNS-based features, and an optimization of the SNN model. The MADONNA-based model performs competitively against the best previous ML-based malicious domain detection models, outperforming them in terms of accuracy, F1-score, precision, and recall.…