Malicious Domain Detection Using Statistical Features of Domain Strings, Public Information, and DNS Logs

Domain names, which are indispensable for accessing Internet services, are also exploited by attackers to direct users to phishing sites or malware-infected sites. Therefore, determining whether a domain name is malicious or not is crucial for security measures. In this paper, we perform malicious domain detection using a publicly available dataset that includes statistical features of domain strings, publicly available information from sources such as WHOIS, and DNS query and response information. As a result, we achieve a recall of 0.940 and an F1-score of 0.968 with a Random Forest classifier, a recall of 0.946 and an Fl-score of 0.968 with both Random Forest and XGBoost classifiers using only statistical features, and a recall of 0.983 and an Fl-score of 0.986 with an XGBoost classifier using statistical features and DNS query and response information.