Speaker
Description
This presentation describes a hybrid malicious-domain detection system deployed in an academic recursive DNS resolver operated by São Paulo State University (UNESP), processing more than 20 million DNS queries per day. The system combines automatically updated open-source threat-intelligence feeds with a lightweight Random Forest classifier designed for operational passive-DNS monitoring.
The classifier uses 28 lexical and active-DNS features, complemented by character-level TF-IDF representations extracted from domain names. Active features are collected through DNS-over-HTTPS queries. On an offline test set of approximately 50,000 previously unseen domains, the best configuration achieved an ROC-AUC of 0.918, precision of 0.794, recall of 0.832, and F1-score of 0.813.
The system was also evaluated during a one-year deployment using passive DNS data collected throughout 2025. It identified between 512 and 1,439 potentially malicious domains per month beyond direct threat-intelligence matches. However, real-world evaluation exposed a substantial precision gap: monthly precision ranged from 0.142 to 0.364, while recall ranged from 0.434 to 0.667. Furthermore, 74%–78% of observed domains could not be validated using available blocklists or allowlists.
The results demonstrate that machine learning can complement blocklists by expanding threat visibility, but production deployment requires careful thresholding, analyst validation, and approaches for handling incomplete labels and extreme class imbalance. The system is therefore best understood as an early-warning and triage capability rather than an autonomous blocking mechanism.
| Talk duration | 15 Minutes (pre-recorded no Q&A) |
|---|
