# A Survey on Malicious Domains Detection through DNS Data Analysis

arXiv: https://arxiv.org/abs/1805.08426 · HTML: https://mlsanity.com/paper/1805.08426/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 May 2018.

## Built on by (most cited first, 9 of 9)

- [Characterizing Malicious URL Campaigns](https://mlsanity.com/paper/2108.12726/) (2021)
- [Improving DGA-Based Malicious Domain Classifiers for Malware Defense with Adversarial Machine Learning](https://mlsanity.com/paper/2101.00521/) (2021)
- [CELEST: Federated Learning for Globally Coordinated Threat Detection](https://mlsanity.com/paper/2205.11459/) (2022)
- [Identifying malicious accounts in Blockchains using Domain Names and associated temporal properties](https://mlsanity.com/paper/2106.13420/) (2021)
- [Detection of Malicious Websites Using Machine Learning Techniques](https://mlsanity.com/paper/2209.09630/) (2022)
- [JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection](https://mlsanity.com/paper/2306.05698/) (2023)
- [Multi-Instance Adversarial Attack on GNN-Based Malicious Domain Detection](https://mlsanity.com/paper/2308.11754/) (2023)
- [Gravity Falls: A Comparative Analysis of Domain-Generation Algorithm (DGA) Detection Methods for Mobile Device Spearphishing](https://mlsanity.com/paper/2603.03270/) (2026)
- [DNS-GT: A Graph-based Transformer Approach to Learn Embeddings of Domain Names from DNS Queries](https://mlsanity.com/paper/2603.11200/) (2026)

## Abstract (arXiv)

Malicious domains are one of the major resources required for adversaries to run attacks over the Internet. Due to the important role of the Domain Name System (DNS), extensive research has been conducted to identify malicious domains based on their unique behavior reflected in different phases of the life cycle of DNS queries and responses. Existing approaches differ significantly in terms of intuitions, data analysis methods as well as evaluation methodologies. This warrants a thorough systematization of the approaches and a careful review of the advantages and limitations of every group. In this paper, we perform such an analysis. In order to achieve this goal, we present the necessary background knowledge on DNS and malicious activities leveraging DNS. We describe a general framework of malicious domain detection techniques using DNS data. Applying this framework, we categorize existing approaches using several orthogonal viewpoints, namely (1) sources of DNS data and their enrichment, (2) data analysis methods, and (3) evaluation strategies and metrics. In each aspect, we discuss the important challenges that the research community should address in order to fully realize the power of DNS data analysis to fight against attacks leveraging malicious domains.