Unknown Malicious Domain Detection based on DNS Query Analysis using Word2Vec

Malware infection of network user devices is a critical threat to users on the Internet. A major countermeasure against malware infection is a signature-type detection method that uses a blacklist to prevent communication with a Command and Control (C&C) server when the malware attempts a malicious attack. However, if the malicious domain name is unknown to the C&C server, it is difficult for this method to detect the malware. This paper focuses on the behavior of devices infected with malware. We propose a method for unknown malicious domain detection based on domain name system (DNS) query analysis using Word2Vec, a popular machine learning method. We then evaluate the effectiveness of our proposed method using an actual DNS Query log.