Feature Engineering in Unsupervised DNS Botnet Detectors Based on eXplainable AI

Botnet communications often rely on Domain Generation Algorithms (DGAs) to establish channels among attack orchestrators and compromised hosts (bots). Our approach leverages on Artificial Intelligence (AI) to differentiate between legitimate and DGA Domain Name System (DNS) messages, thereby enabling defenders to identify and block botnet communications. Our unsupervised Machine Learning (ML) model involves deep AutoEncoders (AEs), trained on large unlabeled datasets to avoid time-consuming, error-prone labeling procedures and risks of overfitting to training data. Our experiments are based on training datasets of frequently requested names in public repositories; request frequencies point towards name legitimacy. AEs infer legitimate name characteristics, eventually discerning benign names from malicious DGA anomalies. Model evaluation relies on statistical and linguistic features directly extracted from domain names, thus avoiding costly and privacy-sensitive operations on historical databases with DNS information. Our proposed schema interprets black-box models by employing SHapley Additive exPlanation (SHAP), a prominent eXplainable Artificial Intelligence (XAI) technique that derives model-agnostic and post-hoc interpretations to assess feature contributions on model decisions. Specifically, we introduce a SHAP-driven feature augmentation mechanism that systematically re-engineers the feature space and improves model performance. Experimental results on large-scale datasets demonstrate that the proposed approach effectively detects DGA-generated domains, while the augmented model achieves noticeable improvements in both detection accuracy and F1-score. In summary, our approach provides a scalable, interpretable, and privacy-aware framework for DNS security, highlighting the potential of combining unsupervised learning with XAI.