Improving Cyber Defense with DNS Query Clustering Analysis
Radi Khaoula, Moughit Imane, Mohamed Moughit · 2024
The Domain Name System (DNS) serves as a critical component of internet infrastructure, facilitating the translation of domain names to IP addresses. However, its widespread usage also renders it a prominent target for cyber threats. Detecting and mitigating malicious activities within DNS queries are imperative for upholding online security standards. This study investigates the effectiveness of clustering algorithms in identifying and analyzing malicious activity within domain names and IP addresses. By employing various clustering techniques such as k-means, DBSCAN, hierarchical clustering, and Gaussian mixture models (GMM) on DNS query datasets, insightful patterns and trends are uncovered to reveal potential threats. To augment the accuracy and efficiency of clustering algorithms, advanced preprocessing techniques like principal component analysis (PCA) and t-distributed stochastic neighbor embedding (t-SNE) are utilized. These techniques aid in reducing data dimensionality while preserving essential characteristics, thereby enabling the capture of intricate relationships within DNS queries and the more effective identification of malicious behavior. Our research underscores the superiority of specific clustering algorithms in accurately detecting malicious activity compared to others. Furthermore, we demonstrate how integrating dimensionality reduction techniques significantly enhances the performance of these algorithms, enabling more precise identification and classification of threats. By offering a comprehensive evaluation of clustering algorithms and preprocessing methods for DNS query analysis, this study equips cybersecurity professionals with valuable insights to safeguard against potential threats and fortify the security of DNS infrastructure. The findings presented in this paper provide compelling evidence of the efficacy of clustering techniques in combating cyber attacks, paving the way for advanced defense mechanisms and improved cybersecurity practices in the diaital landscape.