Table 2 Traffic feature summarize
From: PUMD: a PU learning-based malicious domain detection framework
Feature set | ID | Type | Feature name | Mali DN profile |
|---|---|---|---|---|
Domain resolution response feature | 8 | */\(\dagger\) | Number of unique IP addresses | Greater |
9 | */\(\dagger\) | Number of unique RR types | Greater | |
10 | */\(\dagger\) | Range of unique RR parsing times | Lesser | |
11 | \(\dagger\) | Number of unique domains hosted on IP pool | Greater | |
12 | \(\dagger\) | Number of unique countries that IP pool belongs to | Greater | |
13 | \(\dagger\) | Number of unique subvisions that IP pool belongs to | Greater | |
Client resolution request Feature | 14 | */\(\dagger\) | Number of unique client | Lesser |
15 | */\(\dagger\) | Number of request count | Lesser | |
16 | \(\dagger\) | Number of domains requested by client pool | Greater | |
17 | * | Ratio of the most frequent request hour to all-day requests | Greater | |
18 | * | Number of request count in different request period | Greater |