# Ensemble-based Feature Selection and Classification Model for DNS Typo-squatting Detection

arXiv: https://arxiv.org/abs/2006.09272 · HTML: https://mlsanity.com/paper/2006.09272/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Jun 2020.

## Built on by (most cited first, 6 of 6)

- [Machine Learning Towards Intelligent Systems: Applications, Challenges, and Opportunities](https://mlsanity.com/paper/2101.03655/) (2021)
- [Multi-Perspective Content Delivery Networks Security Framework Using Optimized Unsupervised Anomaly Detection](https://mlsanity.com/paper/2107.11514/) (2021)
- [An Attention-based ConvLSTM Autoencoder with Dynamic Thresholding for Unsupervised Anomaly Detection in Multivariate Time Series](https://mlsanity.com/paper/2201.09172/) (2022)
- [Anomaly Detection in Intra-Vehicle Networks](https://mlsanity.com/paper/2205.03537/) (2022)
- [TypoSwype: An Imaging Approach to Detect Typo-Squatting](https://mlsanity.com/paper/2209.00783/) (2022)
- [Optimized Ensemble Model Towards Secured Industrial IoT Devices](https://mlsanity.com/paper/2401.05509/) (2024)

## Abstract (arXiv)

Domain Name System (DNS) plays in important role in the current IP-based Internet architecture. This is because it performs the domain name to IP resolution. However, the DNS protocol has several security vulnerabilities due to the lack of data integrity and origin authentication within it. This paper focuses on one particular security vulnerability, namely typo-squatting. Typo-squatting refers to the registration of a domain name that is extremely similar to that of an existing popular brand with the goal of redirecting users to malicious/suspicious websites. The danger of typo-squatting is that it can lead to information threat, corporate secret leakage, and can facilitate fraud. This paper builds on our previous work in [1], which only proposed majority-voting based classifier, by proposing an ensemble-based feature selection and bagging classification model to detect DNS typo-squatting attack. Experimental results show that the proposed framework achieves high accuracy and precision in identifying the malicious/suspicious typo-squatting domains (a loss of at most 1.5% in accuracy and 5% in precision when compared to the model that used the complete feature set) while having a lower computational complexity due to the smaller feature set (a reduction of more than 50% in feature set size).