Phoenix: DGA-Based Botnet Tracking and Intelligence

Stefano Schiavoni, Federico Maggi, Lorenzo Cavallaro, Stefano Zanero

Research output: Contribution to journalArticlepeer-review

189 Citations (Scopus)
219 Downloads (Pure)


Modern botnets rely on domain-generation algorithms (DGAs) to build resilient command-and-control infrastructures. Given the prevalence of this mechanism, recent work has focused on the analysis of DNS traffic to recognize botnets based on their DGAs. While previous work has concentrated on detection, we focus on supporting intelligence operations. We propose Phoenix, a mechanism that, in addition to telling DGA- and non-DGA-generated domains apart using a combination of string and IP-based features, characterizes the DGAs behind them, and, most importantly, finds groups of DGA-generated domains that are representative of the respective botnets. As a result, Phoenix can associate previously unknown DGA-generated domains to these groups, and produce novel knowledge about the evolving behavior of each tracked botnet. We evaluated Phoenix on 1,153,516 domains, including DGA-generated domains from modern, well-known botnets: without supervision, it correctly distinguished DGA- vs. non-DGA-generated domains in 94.8 percent of the cases, characterized families of domains that belonged to distinct DGAs, and helped researchers “on the field” in gathering intelligence on suspicious domains to identify the correct botnet.
Original languageEnglish
Pages (from-to)192-211
Number of pages20
JournalDetection of Intrusions and Malware, and Vulnerability Assessment (DIMVA)
Publication statusPublished - 10 Jul 2014


  • Botnet, DGA, Malware


Dive into the research topics of 'Phoenix: DGA-Based Botnet Tracking and Intelligence'. Together they form a unique fingerprint.

Cite this