An Imbalanced Malicious Domains Detection Method Based on Passive DNS Traffic Analysis

Abstract EN

Although existing malicious domains detection techniques have shown great success in many real-world applications, the problem of learning from imbalanced data is rarely concerned with this day.

But the actual DNS traffic is inherently imbalanced; thus how to build malicious domains detection model oriented to imbalanced data is a very important issue worthy of study.

This paper proposes a novel imbalanced malicious domains detection method based on passive DNS traffic analysis, which can effectively deal with not only the between-class imbalance problem but also the within-class imbalance problem.

The experiments show that this proposed method has favorable performance compared to the existing algorithms.