# DNS Firewall Based on Machine Learning
## 5 Data Analysis
### Machine Learning: Classification
Six different algorithms were used: SVM, LR, LDA, KNN, CART, and NB. The results were collected and analyzed, and we verified that the CART algorithm is the best algorithm considering the RFE feature selection method. Additionally, considering the existence of automatic ML processes, the effectiveness of this type of processes was also analyzed. We used AutoML, and a slight improvement in accuracy was observed but, as a drawback, an increase in the time to classify a set of domains was also observed. The classification results achieved with our approach are very interesting. The results show an accuracy above 96% and a low time to classify, which is a good indicator to further explore the application and adopt it for a real scenario. The results obtained from the ML algorithms can also be used by researchers for future research in this field. With the creation of a DNS firewall as we propose, the DNS core service is not affected. The DNS will respond to the requests, however, considering the classification result, the IP associated with the name of the request may be changed to block the connection. For example, in response to a resolution request, the DNS server may respond with the IP address 127.0.0.1, sinking the communication, thus avoiding malicious communications. Finally, we must consider that all this work was carried out in a laboratory environment, so there is a great limitation in terms of tests in real scenario. With the creation of a prototype and testing in a real environment, we will certainly observe different results due to both the volume of orders and the variance in their characteristics. These tests will be essential to improve and make this solution more robust. C.M. : Investigation, Software, Data curation, Writing--original draft, Visualization. S.M. : Formal analysis, Writing--review & editing. J.M. : Conceptualization, Methodology, Formal analysis, Writing--review & editing. All authors have read and agreed to the published version of the manuscript. This work was partially supported by the Norte Portugal Regional Operational Programme (NORTE 2020), under the PORTUGAL 2020 Partnership Agreement, through the European Regional Development Fund (ERDF), within project \"Cybers SeC IP\" (NORTE-01-0145-FEDER-000044). The dataset used in this study is openly available in Mendeley Data repository at 10.17632/623 sshkdrz.5, version number 5. The authors declare no conflict of interest. ## Abbreviations

The following abbreviations are used in this manuscript: \begin{tabular}{l l} AutoML & Automated Machine Learning \\ CART & Decision Tree \\ CSV & Comma-separated Values \\ DDOS & Distributed Denial of Service \\ DGA & Domain generation algorithm \\ DNS & Domain Name Service \\ DNSSEC & DNS Security Extensions \\ GDPR & General Data Protection Regulation \\ IP & Internet Protocol \\ KNN & K-Nearest Neighbors \\ LDA & Linear Discriminant Analysis \\ LR & Logistic Regression \\ ML & Machine Learning \\ NB & Naive Bayes \\ OSINT & Open Source Intelligence \\ RBF & Radial basis function \\ RFC & Request For Comments \\ RFE & Recursive Feature Elimination \\ SANS & SANS Internet Storm Center \\ SVM & Support-Vector Machine \\ TLD & Top Level Domain \\ TTL & Time To Live \\ \end{tabular} 

## References

* Verisign (2021) Verisign. The Domain Name Industry Brief. Available online: [[https://www.verisign.com/en_US/domain-names/dnib/index.xhtml](https://www.verisign.com/en_US/domain-names/dnib/index.xhtml)]([https://www.verisign.com/en_US/domain-names/dnib/index.xhtml](https://www.verisign.com/en_US/domain-names/dnib/index.xhtml)) (accessed on 28 November 2021). * Scmagazine (2020) Scmagazine. Vast Majority of Newly Registered Domains Are Malicious.