MALICIOUS DOMAIN DETECTION USING INTEGRATED SUPERVISED AND UNSUPERVISED MACHINE LEARNING APPROACHES

Detecting Domain Generation Algorithms (DGA) is crucial in cybersecurity to identify malicious domain names. While existing studies focus individually on either supervised or unsupervised learning, limited work has explored their integrated use for DGA detection. This paper addresses that gap by combining clustering-derived features with traditional classifiers to enhance detection accuracy. This paper explores an innovative approach for DGA detection utilizing supervised classification and unsupervised clustering techniques. The methodology begins with preprocessing the dataset and extracting relevant features, such as domain names, host information, and subclass labels. Later, feature hashing is utilized for dimensionality reduction, transforming categorical features like domain names, hosts, and subclasses into feature vectors. Advanced clustering methods, including KMeans, Hierarchical Clustering (Agglomerative), and Density-Based Clustering (DBSCAN), are employed to uncover underlying patterns in the data. These techniques aid in identifying distinct groups or clusters within the dataset, potentially assisting in differentiating DGA from legitimate domain names. Later, cluster labels were added as features for final dataset. Subsequently, multiple ML classifiers, including Random Forest, Decision Tree, KNN, SVM, and Logistic Regression, are trained to classify domain names as DGA or non-DGA based on the extracted features. Rigorous experimentation and evaluation assess the performance of each classifier in terms of accuracy and other relevant metrics. This hybrid approach contributes new knowledge on how feature enrichment through clustering can improve model generalization in real-world cyber threat scenarios. The results offer insights into the effectiveness of the proposed methodologies for DGA detection.