A Survey of DNS Traffic Analysis for Detecting DGA-based C2 Communication Channels

Malware families that rely on domain generation algorithms (DGAs) can produce hundreds of candidate domain names a day, and their bots try them one after another until one points to a live command-and-control (C2) server. Since most of those names are never registered, a static blocklist catches very little. Defenders have therefore turned to the Domain Name System itself, which every infected host must use before it can reach its operator. This survey reviews the research on spotting DGA-based C2 activity from DNS queries and responses. We sort the work into three groups: analysis of the domain strings, analysis of resolution behaviour and passive DNS records, and hybrid systems that feed both kinds of evidence into machine learning classifiers. Random Forest and other tree ensembles receive particular attention, because they are accurate enough, fast enough and readable enough to run in real networks. We also look at the datasets, features and metrics that the studies use, and we point out where differences in those choices make results hard to compare. The paper ends with open problems, including adversarial robustness, encrypted DNS and generalization across datasets.