DNS Firewall Based on Machine Learning

Claudio Marques, Silvestre Malta and João Magalhães
Additional contact information
Claudio Marques: ESTG (Escola Superior de Tecnologia e Gestão), Instituto Politécnico de Viana do Castelo, 4900-367 Viana do Castelo, Portugal
Silvestre Malta: ADiT-Lab (Applied Digital Transformation Laboratory), ESTG (Escola Superior de Tecnologia e Gestão), Instituto Politécnico de Viana do Castelo, 4900-367 Viana do Castelo, Portugal
João Magalhães: CIICESI (Centro de Inovação e Investigação em Ciências Empresariais e Sistemas de Informação), ESTG (Escola Superior de Tecnologia e Gestão), Instituto Politécnico do Porto, 4610-156 Porto, Portugal

Future Internet, 2021, vol. 13, issue 12, 1-18

Abstract: Nowadays there are many DNS firewall solutions to prevent users accessing malicious domains. These can provide real-time protection and block illegitimate communications, contributing to the cybersecurity posture of the organizations. Most of these solutions are based on known malicious domain lists that are being constantly updated. However, in this way, it is only possible to block malicious communications for known malicious domains, leaving out many others that are malicious but have not yet been updated in the blocklists. This work provides a study to implement a DNS firewall solution based on ML and so improve the detection of malicious domain requests on the fly. For this purpose, a dataset with 34 features and 90 k records was created based on real DNS logs. The data were enriched using OSINT sources. Exploratory analysis and data preparation steps were carried out, and the final dataset submitted to different Supervised ML algorithms to accurately and quickly classify if a domain request is malicious or not. The results show that the ML algorithms were able to classify the benign and malicious domains with accuracy rates between 89% and 96%, and with a classification time between 0.01 and 3.37 s. The contributions of this study are twofold. In terms of research, a dataset was made public and the methodology can be used by other researchers. In terms of solution, the work provides the baseline to implement an in band DNS firewall.

Keywords: cybersecurity; DNS; firewall; machine learning (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2021
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/13/12/309/pdf (application/pdf)
https://www.mdpi.com/1999-5903/13/12/309/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:13:y:2021:i:12:p:309-:d:692147

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().