论文标题
基于DNS查询的僵尸网络检测的优化随机森林模型
Optimized Random Forest Model for Botnet Detection Based on DNS Queries
论文作者
论文摘要
域名系统（DNS）协议在当今的Internet中起着重要作用，因为它在网站名称和相应的IP地址之间转换。但是，由于缺乏数据完整性和来源身份验证的流程，DNS协议具有多个安全漏洞。这通常会导致各种网络攻击，包括僵尸网络攻击。检测基于DNS的僵尸网络攻击的一种有希望的解决方案是采用基于机器的解决方案（ML）解决方案。为此，本文提出了一个新型的基于ML的框架，以根据其相应的DNS查询来检测僵尸网络。更具体地说，该框架包括使用信息增益作为特征选择方法和遗传算法（GA）作为超参数优化模型来调整随机森林（RF）分类器的参数。使用最先进的TI-2016 DNS数据集评估所提出的框架。实验结果表明，提出的优化框架将特征集尺寸降低了60％。此外，与默认分类器相比，它达到了高检测精度，精度，召回和F得分。这突出了拟议框架在检测僵尸网络攻击方面的有效性和鲁棒性。
The Domain Name System (DNS) protocol plays a major role in today's Internet as it translates between website names and corresponding IP addresses. However, due to the lack of processes for data integrity and origin authentication, the DNS protocol has several security vulnerabilities. This often leads to a variety of cyber-attacks, including botnet network attacks. One promising solution to detect DNS-based botnet attacks is adopting machine learning (ML) based solutions. To that end, this paper proposes a novel optimized ML-based framework to detect botnets based on their corresponding DNS queries. More specifically, the framework consists of using information gain as a feature selection method and genetic algorithm (GA) as a hyper-parameter optimization model to tune the parameters of a random forest (RF) classifier. The proposed framework is evaluated using a state-of-the-art TI-2016 DNS dataset. Experimental results show that the proposed optimized framework reduced the feature set size by up to 60%. Moreover, it achieved a high detection accuracy, precision, recall, and F-score compared to the default classifier. This highlights the effectiveness and robustness of the proposed framework in detecting botnet attacks.
