Analysis of Failed DNS Responses Using Neural Network in Botnet Detection

With the increasing development of technology and the expansion of the use of the Internet, botnets are considered as one of the most important security threats in the digital space. Botnets are networks of infected devices controlled by attackers and used for various purposes such as sending spam, DDoS attacks, and stealing sensitive information. Considering the increasing trend of using botnets, it is very important to detect and prevent their activity. The spread of communication, resource sharing, curiosity, earning money, gathering information and gaining resource capacity are motivations for creating botnets. In addition to these, political, economic and military motives should also be added. Our method has the ability to detect known and unknown botnets that use this method. Our goal in this paper is to present an innovative method to detect botnets using failed response analysis and neural network. In this method, botnets are detected based on failed responses or NXDomain in each host. This feature increases the accuracy of detection in small and medium networks. This method has been tested in networks infected with Konfiker and Kraken botnets and the information obtained from it has been analyzed using neural networks. The evaluation results show the good performance of this method in botnet detection.