Quezada Pauta, Vicente GeovannyAstudillo Salinas, Darwin Fabián2023-10-032023-10-0320231389-1286http://dspace.ucuenca.edu.ec/handle/123456789/42999https://www.scopus.com/record/display.uri?eid=2-s2.0-85151397842&origin=resultslist&sort=plf-f&src=s&sid=fabc4659b4b8ab2a3a09d48deb0ba195&sot=b&sdt=b&s=TITLE-ABS-KEY%28Real-time+bot+infection+detection+system+using+DNS+fingerprinting+and+machine-learning%29&sl=101&sessionSearchId=fabc4659b4b8ab2a3a09d48deb0ba195In today's cyberattacks, botnets are used as an advanced technique to generate sophisticated and coordinated attacks. Infected systems connect to a command and control (C&C) server to receive commands and attack. Thus, detecting infected hosts makes it possible to protect the network's resources and prevent them from illicit activities toward third parties. This research elaborates on the design, implementation, and results of a bot infection detection system based on Domain Name System (DNS) traffic events for a network corporation. An infection detection feasibility analysis is performed by creating fingerprints. The traces are generated from a numerical analysis of 13 attributes. These attributes are obtained from the DNS logs of a DNS server. It looks for fingerprint anomalies using Isolation Forest to label a host as infected or not. In addition, on the traces cataloged as anomalous, a search will be carried out for queries to domains generated by Domain Generation Algorithms (DGA). Then, Random Forest generates a model that detects future bot infections on hosts. The devised system integrates the ELK stack and Python. This integration facilitates the management, transformation, and storage of events, generation of fingerprints, machine learning application, and analysis of fingerprint classification results with a precision greater than 99%.es-ESMachine learningAnomaly detectionBot detectionBotnetDNS-based bot detectionELK stackIsolation forestsRandom forestsARTÍCULO10.1016/j.comnet.2023.109725