How non-existent domain names can unveil DGA botnets

This report outlines how NXDomain responses can be leveraged to detect DGA-based botnets, detailing methods such as sequential hypothesis testing for host reputation, DNS failure graphs for co-clustering, prefiltering and clustering of hosts by NXDomain similarity, and augmenting with lexical and behavioral features. It highlights the need for whitelisting and careful tuning to reduce false positives from benign applications and acknowledges potential evasion strategies by botnets.