Assessment of Machine Learning Models in Detecting DGA Botnet in Characteristics by TF-IDF

Botnets are a significant threat to information systems on the Internet. Some solutions are proposed to detect and prevent botnets, such as anomaly-based, signature-based, or behavior-based. In this article, we present our study on the application of machine learning models to detect DGA botnets. With some contribution, including using TF-IDF and n-gram for feature representation, propose a machine learning model based on voting and assessment on UMUDGA datasets, which contains more DGA botnet families compared with previous datasets. The results show that machine learning models show high efficiency in detecting DGA botnet. Accordingly, logistic regression and SVM are the most effective, with F1-score of 97.0% and 96.9%, respectively. The proposed voting-based model also has higher accuracy rate than single models, with the F1-score reaching 98.2% in the soft-voting model.