A comparative analysis of supervised machine learning models for threat detection in domain name system

The Domain Name System (DNS) is an important element of the Internet. It serves as the standard method for translating human-readable domain names into machine-readable IP addresses. Despite its importance, DNS has persistently challenged by various threats that compromise its security and functionality. Various machine learning models have been proposed to detect and classify DNS attacks. This work aims to provide a comparative analysis of three supervised machine learning models: Random Forest, Vector-Based, and XGBoost. These models were trained and tested for the classification of DNS threats in 11 different categories. Among all three models, XGBoost consistently outperforms Random Forest and the Vector-Based model in terms of accuracy, speed, confidence, precision, recall, and F1-score. It provides the highest detection accuracy (56.4%), the fastest processing speed (10,263 domains/sec), and the lowest false alarm rate (4.3%), making it the most reliable choice for malicious domain detection. In addition to examining the DNS threat landscape and existing challenges, this research also highlights the strengths and limitations of the existing state of the art and provides future research directions for researchers to understand DNS vulnerabilities and current gaps in their mitigation techniques.