Artificial Intelligence and Machine Learning for Intelligent DNS Threat Detection

Artificial intelligence, machine learning, and deep learning have demonstrated significant potential for improving DNS security across multiple threat categories. The 15 studies reviewed in this paper show that different learning paradigms can address different forms of DNS abuse, including malicious domains, Domain Generation Algorithms, DNS botnet behavior, DNS exfiltration, encrypted DNS, and DNS-related structural anomalies. Conventional machine learning provides effective approaches for structured DNS and traffic features, while deep learning, unsupervised learning, and graph-based methods provide additional capabilities for sequential, anomalous, and relational analysis. The review also shows that detection performance alone is insufficient for evaluating an Al-driven DNS-security system. Dataset dependence, evolving attack behavior, limited visibility in encrypted DNS, explainability requirements,  adversarial vulnerabilities, privacy considerations, and large-scale deployment  requirements remain important challenges. The reviewed studies address many of these issues individually, but their capabilities remain distributed across different threat categories, data representations, and system architectures. Based on the comparative analysis, seven major research gaps were identified: fragmented multi-threat detection, limited cross-dataset generalization, evolving and previously unseen DGA behavior, reduced visibility in encrypted DNS, insufficient operational explainability, adversarial vulnerability, and real-time scalability. These gaps indicate that future DNS-security research should move toward architectures that combine complementary detection methods rather than relying on a single model or threat-specific solution. To address this direction, a conceptual unified Al-driven DNS security framework was proposed. The framework combines specialized Al-based detection for different DNS threat characteristics with risk fusion, explainable Al, and a MERN-based monitoring layer. Python-based Al processing is intended to support model training and inference, while React, Node.js, Express, and MongoDB provide the application and monitoring components. The framework is presented as a conceptual research direction and has not been experimentally validated in this review. Future research should therefore focus on adaptive learning for evolving DNS threats, hybrid sequential and graph-based models, adversarially robust detection, privacy-preservinglearning, scalable edge or in-network processing, and operationally useful explainable Al. Experimental implementation and evaluation of the proposed framework will benecessary to determine its effectiveness in terms of detection performance, cross-dataset generalization, robustness, inference latency, scalability, and practical security-operations support.

[1]           Javed, I. Rashid, S.Tahir, S. Saeed, A. M. Almuhaideb, and K. Alissa, "AdamW+: Machine learning framework to detect domain generation algorithms for malware," IEEE Access, vol. 12, 2024, doi: 10.1109/ACCESS.2024.3407546. [2]           R. Panigrahi, P. K. Sethy, S. K. Behera, M. Gupta, F. A. Alenizi, P. Suanpang, and A. Nanthaamornphong, "Analytical validation and integration of CIC-Bell-DNS-EXF-2021 dataset on security information and event management," IEEE Access, vol. 12, 2024, doi: 10.1109/ACCESS.2024.3409413. [3]          L. Hanintya, P. Sukarno, and A. A. Wardana, "Comparing explainable Al framework: Study case on detection of DNS exfiltration attack using neural network," Procedia Computer Science, vol. 269, pp. 1022-1032, 2025, doi: 10.1016/j.procs.2025.09.044. [4]          M. Anan, M. Nazzal, A. Khreishah, I. Khalil, N. Phan, and A. Sawalmeh, "STING: A stealthy backdoor attack on GNN-based malicious domain detection via DNS perturbations," IEEE Open Journal of the Communications Society, vol. 6, 2025, doi: 10.1109/0JCOMS.2025.3610784. [5]          M. Singh, M. Singh, and S. Kaur, "Tl-16 DNS labeled dataset for detecting botnets," IEEE Access, vol. 11, 2023, doi: 10.1109/ACCESS.2023.3287141. [6]           K. Jerabek, K. Hynek, 0. Rysavy, and I. Burgetova, "DNS over HTTPS detection using standard flow telemetry," IEEE Access, vol. 11, 2023, doi: 10.1109/ACCESS.2023.3275744. [7]          L.A. C.Ahakonye, G. C. Amaizu, C. I. Nwakanma, J.M. Lee, and D.-S. Kim, "Classification and characterization of encoded traffic in SCADA network using hybrid deep learning scheme," Journal of Communications and Networks, vol. 26, no. 1, pp. 65-76, Feb. 2024. [8]          Arkadopoulou, N. Kostopoulos, M. Grammatikou, and V. Maglaris, "Feature engineering in 2unsupervised DNS botnet detectors based on eXplainable Al," IEEE Access, vol. 14, 2026, doi: 10.1109/ACCESS.2026.3687021. [9]           Y. Baseri, M. Daghmehchi Firoozjaei, S. Sadeghi, A. Ghorbani, and W. Belanger, "Proactive cyber defense: User-centric risk assessment in DNS traffic through graph-based learning," IEEE Access, vol. 14, 2026, doi: 10.1109/ACCESS.2025.3648445. [10]          J B. Ali and G. Chen, "Neuromorphic quantum adversarial learning (NQAL): A bio-inspired paradigm for DNS over HTTPS threat detection," EURASIP Journal on Information Security, vol. 2025, Art. no. 35, 2025, doi: 10.1186/s13635-025-00215-5.