Host-Level Botnet Detection via Internet DNS Traffic Analysis Using Neural Networks

Abstract

Botnets remain one of the most significant threats in Internet security, performing large-scale attacks such as distributed denial of service (DDoS), data exfiltration, and financial fraud. Detecting botnet activity at the host level is crucial for early mitigation, particularly by analyzing anomalies in domain name system (DNS) query sequences. This study proposes a deep learning-based DNS sequence analysis that leverages Bidirectional Gated Recurrent Units (BiGRU) to identify deviations in DNS query behavior indicative of botnet activity. The model learns temporal patterns in DNS sequences, distinguishing legitimate traffic from botnet-generated queries by capturing contextual dependencies over time. The proposed approach is trained and evaluated on a UNSW-NB15 dataset. The performance assessment of the proposed model demonstrates its effectiveness in detecting botnets with an accuracy of 99.22%. The comparative analysis with the existing approaches highlights the improvements in detection accuracy with a low misclassification rate.