Skip to main content
Article
Malware detection using DNS records and domain name features
ACM International Conference Proceeding Series
  • Khulood Al Messabi, Zayed University
  • Monther Aldwairi, Zayed University
  • Ayesha Al Yousif, Zayed University
  • Anoud Thoban, Zayed University
  • Fatna Belqasmi, Zayed University
Document Type
Conference Proceeding
Publication Date
6-26-2018
Abstract

© 2018 ACM. As billions of people depend on Internet application to perform day to day tasks, the prevalent of malwares and online attacks cause a huge loss to global Internet economy prevalent. Domain name system is one of the core components of the Internet, which allows users to type in website names and resolves them to Internet addresses. Several studies proposed using DNS for malware detection, because it is the first step before visiting a specific website. Unfortunately, majority focused on malicious URLs back listing, botnets, top-level-domain, DNS and resolvers. This paper proposes a system to detect malicious domain names, by using eight unique features that accurately identify malicious websites before being visited.We implemented our approach of malicious domain names detection using Python, and experimented with five weeks of real-world data using Weka.The experimental results reports a 77.5% and low false positive rates 22.4%. That is very promising considering the approach detect website based on feature calculated based on URL and without downloading the file.

ISBN
9781450364287
Publisher
Association for Computing Machinery
Disciplines
Keywords
  • DNS,
  • Domain name,
  • Malicious domains,
  • Malware detection
Scopus ID
85055416272
Indexed in Scopus
Yes
Open Access
No
https://doi.org/10.1145/3231053.3231082
Citation Information
Khulood Al Messabi, Monther Aldwairi, Ayesha Al Yousif, Anoud Thoban, et al.. "Malware detection using DNS records and domain name features" ACM International Conference Proceeding Series (2018) p. 29
Available at: http://works.bepress.com/fatna-belqasmi/6/