CLEAN : An approach for detecting benign domain names based on passive DNS traffic

Abstract

Domain name plays a crucial role on the Internet. Therefore, more and more malicious behavior had been conducted by using the domain name, such as spam, botnet, phishing and the like. Thus, lots of research have been done for detecting these malicious domain names. Nevertheless, the effort focused on benign domain names is little. It is obvious that finding more benign domain names accurately is very helpful for detecting malicious domain names. In this paper, we analyze a great number of domain names and propose a method, CLEAN(CLassifier of bEnign domAin Names), for discovering benign domain names from plenty of domain names on the passive DNS traffic. Eventually, we conducted the experiment to check the effect. The result showed the recall rate is 82.1% and accuracy rate is 92.2%.