A DGA Detection Method Based on Spatiotemporal Features of DNS and NetFlow Traffic

Nowadays, the use of Domain Generation Algorithm (DGA) in botnets has made the detection of DGA domain names very important. Compared with blacklist and character-based detection, traffic analysis has the advantages of small datasets and vocabulary. However, the current research of traffic analysis mainly use a single type of traffic, and few features in the traffic has been considered. In this paper, a DGA domain name detection method based on spatiotemporal features of DNS and NetFlow traffic is proposed. Based on the difference between the traffic performance of DGA and benign domain name after the attack behavior, the method selects 8 effective features in time and space from DNS and NetFlow traffic, including the number of user IP visits, the suddenness of user access, and the standard deviation mean ratio of the occurrence of each resolved IP address. Using these spatiotemporal features, we can detect DGA domain names from the network. During the detection process, the features extracted from the training set were put into the C4.5 supervised machine learning classification model for training, and the DGA domain name detection system with classification ability was obtained. Experimental results in China Telecom network show that the model can detect DGA domain names with a high accuracy rate of 99.14% in the actual network, including anti-detection DGA domain names. This indicates that the model has achieved long-term effectiveness and stability, and copes well with adversarial attacks.