Snehal Patil, Sakshi Randive, Pranav Jagtap, Darshan More, Kunal Badhe

DOI: https://doi.org/10.5281/zenodo.24129391

Malware families that rely on domain generation algorithms (DGAs) can produce hundreds of candidate domain names a day, and their bots try them one after another until one points to a live command-and-control (C2) server. Since most of those names are never registered, a static blocklist catches very little. Defenders have therefore turned to the Domain Name System itself, which every infected host must use before it can reach its operator. This survey reviews the research on spotting DGA-based C2 activity from DNS queries and responses. We sort the work into three groups: analysis of the domain strings, analysis of resolution behaviour and passive DNS records, and hybrid systems that feed both kinds of evidence into machine learning classifiers. Random Forest and other tree ensembles receive particular attention, because they are accurate enough, fast enough and readable enough to run in real networks. We also look at the datasets, features and metrics that the studies use, and we point out where differences in those choices make results hard to compare. The paper ends with open problems, including adversarial robustness, encrypted DNS and generalization across datasets.

Domain Generation Algorithm, Command and Control, DNS Traffic Analysis, Passive DNS, Random Forest, Malware Detection, Network Security.

DNS traffic gives defenders a practical view of DGA-based C2 activity. The field has moved from inspecting domain strings toward systems that combine lexical, behavioural and passive evidence with machine learning. Random Forest and related ensembles remain attractive because they strike a reasonable balance between accuracy, speed and interpretability. Their results still depend heavily on the data and features behind them. This survey has offered a taxonomy of the field, reviewed the features and classifiers that appear most often, and pointed out the habits that make results hard to compare. The main gaps are the absence of shared benchmarks, thin adversarial evaluation and the growing use of encrypted DNS. Until those gaps are closed, DNS-based detectors should be treated as one layer of defence rather than a complete answer.

[1] L. Ma, L. K. Saul, S. Savage, and G. M. Voelker, “Beyond blacklists: Learning to detect malicious web sites from suspicious URLs,” in Proc. 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2009, pp. 1245–1254.
[2] D. Plohmann, K. Yakdan, M. Klatt, J. Bader, and E. Gerhards-Padilla, “A comprehensive measurement study of domain generating malware,” in Proc. 25th USENIX Security Symposium, 2016, pp. 263–278.
[3] P. Mockapetris, “Domain names: Implementation and specification,” IETF, RFC 1035, Nov. 1987.
[4] M. Antonakakis, R. Perdisci, Y. Nadji, N. Vasiloglou, S. Abu-Nimeh, W. Lee, and D. Dagon, “From throw-away traffic to bots: Detecting the rise of DGA-based malware,” in Proc. 21st USENIX Security Symposium, 2012, pp. 491–506.
[5] L. Bilge, E. Kirda, C. Kruegel, and M. Balduzzi, “EXPOSURE: Finding malicious domains using passive DNS analysis,” in Proc. Network and Distributed System Security Symposium (NDSS), 2011.
[6] Y. Zhauniarovich, I. Khalil, T. Yu, and M. Dacier, “A survey on malicious domains detection through DNS data analysis,” ACM Computing Surveys, vol. 51, no. 4, Art. no. 67, 2018.
[7] S. Yadav, A. K. K. Reddy, A. L. N. Reddy, and S. Ranjan, “Detecting algorithmically generated domain-flux attacks with DNS traffic analysis,” IEEE/ACM Transactions on Networking, vol. 20, no. 5, pp. 1663–1677, 2012.
[8] S. Yadav, A. K. K. Reddy, A. L. N. Reddy, and S. Ranjan, “Detecting algorithmically generated malicious domain names,” in Proc. 10th ACM SIGCOMM Conference on Internet Measurement (IMC), 2010, pp. 48–61.
[9] M. Mowbray and J. Hagen, “Finding domain-generation algorithms by looking at length distributions,” in Proc. IEEE 25th International Symposium on Software Reliability Engineering Workshops, 2014.
[10] M. Antonakakis, R. Perdisci, D. Dagon, W. Lee, and N. Feamster, “Building a dynamic reputation system for DNS,” in Proc. 19th USENIX Security Symposium, 2010.
[11] L. Bilge, S. Sen, D. Balzarotti, E. Kirda, and C. Kruegel, “EXPOSURE: A passive DNS analysis service to detect and report malicious domains,” ACM Transactions on Information and System Security, vol. 16, no. 4, Art. no. 14, 2014.
[12] S. Schiavoni, F. Maggi, L. Cavallaro, and S. Zanero, “Phoenix: DGA-based botnet tracking and intelligence,” in Proc. Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), 2014.
[13] C. Cortes and V. Vapnik, “Support-vector networks,” Machine Learning, vol. 20, no. 3, pp. 273–297, 1995.
[14] L. Breiman, “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001.
[15] F. Pedregosa et al., “Scikit-learn: Machine learning in Python,” Journal of Machine Learning Research, vol. 12, pp. 2825–2830, 2011.
[16] A. Liaw and M. Wiener, “Classification and regression by randomForest,” R News, vol. 2, no. 3, pp. 18–22, 2002.
[17] J. Woodbridge, H. S. Anderson, A. Ahuja, and D. Grant, “Predicting domain generation algorithms with long short-term memory networks,” arXiv preprint arXiv:1611.00791, 2016.
[18] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural Computation, vol. 9, no. 8, pp. 1735–1780, 1997.
[19] J. Saxe and K. Berlin, “eXpose: A character-level convolutional neural network with embeddings for detecting malicious URLs, file paths and registry keys,” arXiv preprint arXiv:1702.08568, 2017.
[20] P. Lison and V. Mavroeidis, “Automatic detection of malware-generated domains with recurrent neural models,” arXiv preprint arXiv:1709.07102, 2017.
[21] K. Highnam, D. Puzio, S. Luo, and N. R. Jennings, “Real-time detection of dictionary DGA network traffic using deep learning,” SN Computer Science, 2021.
[22] R. Vinayakumar, K. P. Soman, P. Poornachandran, S. Akarsh, and S. Sachin Kumar, “Detecting malicious domain names using deep learning approaches at scale,” Journal of Intelligent & Fuzzy Systems, vol. 34, no. 3, 2018.
[23] J. H. Friedman, “Greedy function approximation: A gradient boosting machine,” The Annals of Statistics, vol. 29, no. 5, pp. 1189–1232, 2001.
[24] T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” in Proc. 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2016, pp. 785–794.
[25] R. Sommer and V. Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in Proc. IEEE Symposium on Security and Privacy, 2010, pp. 305–316.

Snehal Patil, Sakshi Randive, Pranav Jagtap, Darshan More, Kunal Badhe (2026). A Survey of DNS Traffic Analysis for Detecting DGA-based C2 Communication Channels. International Journal of Computer Techniques, 13(6), 664–669. ISSN: 2394-2231. DOI: https://doi.org/10.5281/zenodo.24129391