Phoenix: DGA-Based Botnet Tracking and Intelligence

Stefano Schiavoni, Federico Maggi, Lorenzo Cavallaro, Stefano Zanero

Research output: Chapter in Book/Report/Conference proceedingConference contribution

290 Downloads (Pure)


Modern botnets rely on domain-generation algorithms (DGAs) to build resilient command-and-control infrastructures. Given the prevalence of this mechanism, recent work has focused on the analysis of DNS traffic to recognize botnets based on their DGAs. While previous work has concentrated on detection, we focus on supporting intelligence operations. We propose Phoenix, a mechanism that, in addition to telling DGA- and non-DGA-generated domains apart using a combination of string and IP-based features, characterizes the DGAs behind them, and, most importantly, finds groups of DGA-generated domains that are representative of the respective botnets. As a result, Phoenix can associate previously unknown DGA-generated domains to these groups, and produce novel knowledge about the evolving behavior of each tracked botnet. We evaluated Phoenix on 1,153,516 domains, including DGA-generated domains from modern, well-known botnets: without supervision, it correctly distinguished DGA- vs. non-DGA-generated domains in 94.8 percent of the cases, characterized families of domains that belonged to distinct DGAs, and helped researchers “on the field” in gathering intelligence on suspicious domains to identify the correct botnet.
Original languageEnglish
Title of host publicationDetection of Intrusions and Malware, and Vulnerability Assessment (DIMVA)
Place of PublicationLondon
Number of pages20
ISBN (Electronic)978-3-319-08509-8
ISBN (Print)978-3-319-08508-1
Publication statusPublished - 10 Jul 2014


  • Botnet
  • DGA
  • Malware

Cite this