# DNS Firewall Based on Machine Learning
## 5 Data Analysis
### Machine Learning: Classification
\begin{table}
\begin{tabular}{l c c c c} \hline \hline  & **Feature Importance** & **Univariate Selection** & **RFE** & **AutoML** \\ \hline \hline ASN & & & X & X \\ \hline ConsoantRatio & X & X & X & X \\ \hline CountryCode & & & X & X \\ \hline CreationDate & X & X & & \\ \hline DomainLength & X & & X & X \\ \hline HasSPFInfo & X & X & & \\ \hline HttpResponseCode & & X & & \\ \hline Ip & & & X & X \\ \hline LastUpdateDate & & X & & \\ \hline MXDnsResponse & & X & & \\ \hline NumericRatio & X & X & X & \\ \hline NumericSequence & X & & X & X \\ \hline StrangeCharacters & X & X & X & X \\ \hline SubdomainNumber & & & & X \\ \hline TLD & & & X & X \\ \hline TXTDnsResponse & X & X & & \\ \hline VowelRatio & X & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Features importance comparison. The results from the study in [20] reaches a highest accuracy score of 98%. Although the accuracy differs by only 2% when compared with our result, the dataset size is considerably larger which can be a valuable point to take into account for further evaluations and improvements. The result of the study in [6] reinforces the link between the dataset size and the accuracy score. The major advantage of our study consists of the methods used, such as the data preparation with normalization and label encoding, along with the RFE method to select the most important features to feed the model and obtain 96% accuracy using a relatively small dataset. Despite the dataset size, there are also numerous factors to evaluate and analyze in order to improve the ML model, such as the hyperparameter tuning, data preparation, and feature selection processes. The ground base to implement a DNS firewall solution based on ML is completed. As future work, we envisage the implementation in a real scenario as follows: (a) creation of a DNS proxy (which will also work as a firewall), (b) application of our ML model on each request, (c) logging of the results to a future passive analysis and (d) alert/allow/block system to inform the user. The Figure 4 describes the proposed future work. This implementation can be a vital system when applied over a current DNS firewall without ML approaches in real-time to classify domains. The possibility to improve legacy systems is also a valuable point for users and organizations. ## 8 Conclusions

The main objective of our work is to implement a firewall solution based on ML in order to classify DNS requests and filter them regarding the probability of being malicious or not. The development of a DNS firewall based on ML encompasses a set of steps such as the creation of a DNS dataset from DNS logs, the exploratory analysis of the dataset, the data preparation for the ML process, the feature selection by importance and the ML algorithms application to determine the classification accuracy. To accomplish these steps, we firstly created a DNS dataset containing 34 features enriched using OSINT \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Study** & **Algorithms** & **Dataset Size** & **Accuracy** \\ \hline [PERSON] et al. [6] & LR & 10,000 & 60\% \\ [PERSON], F., Jiang, Z., Wang, [PERSON] et al. [20] & ATT-CNN-BiLSTM & 1,308,230 & 98\% \\ Presented in this paper & CART & 90,000 & 96\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Results comparison. Figure 4: DNS Proxy/Firewall. and analytical methods. The resulting dataset is publicly available [51] and can be used by other researchers. After this, the dataset was analyzed to correlate features with the class label providing valuable insights on how the data are distributed by malicious or benign domains. In order to be used by ML algorithms, the data were processed, making use of well known methods such as label encoding and min-max functions to normalize all the values. The feature importance process was made using three distinct methods (feature importance, univariate selection, and RFE), each one with different results. The ML algorithms were selected taking into account the type of analysis (supervised) and the state of art.