Systems and methods for identifying malicious domain names from a passive domain name system server log

A system for identifying malicious domain names from a passive domain name system server log, the system comprising:

• at least one physical processor;
• physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:
• create a pool of domain names at least in part from the passive domain name system server log, wherein the passive domain name system server log is received from a domain name server;
• identify respective features of each domain name in the pool of domain names, wherein at least one of the respective features of each domain name in the pool of domain names describes a domain name server query access pattern of a user;
• prepare a list of known benign domain names and the respective features of each known benign domain name on the list of known benign domain names, wherein the known benign domain names are in the pool of domain names;
• prepare a list of known malicious domain names and the respective features of each known malicious domain name on the list of known malicious domain names, wherein the known malicious domain names are in the pool of domain names;
• compute a classification model based at least in part on:
• the respective features of each known benign domain name on the list of known benign domain names, and
• the respective features of each known malicious domain name on the list of known malicious domain names;
• identify respective features of an unclassified domain name;
• and
• classify, using the classification model, the unclassified domain name as a malicious domain name, based on the respective features of the unclassified domain name.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• create a pool of domain names at least in part from a passive domain name system server log, wherein the passive domain name system server log is received from a domain name server;
• identify respective features of each domain name in the pool of domain names wherein at least one of the respective features of each domain name in the pool of domain names describes a domain name server query access pattern of a user;
• prepare a list of known benign domain names and the respective features of each known benign domain name on the list of known benign domain names, wherein the known benign domain names are in the pool of domain names;
• prepare a list of known malicious domain names and the respective features of each known malicious domain name on the list of known malicious domain names, wherein the known malicious domain names are in the pool of domain names;
• compute a classification model based at least in part on:
• the respective features of each known benign domain name on the list of known benign domain names, and
• the respective features of each known malicious domain name on the list of known malicious domain names;
• identify respective features of an unclassified domain name;
• and
• classify, using the classification model, the unclassified domain name as a malicious domain name, based on the respective features of the unclassified domain name.