Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic

This Unit 42 report describes an autoencoder-based DNS traffic profiling and detection system that converts DNS time-series into fixed-dimensional vectors to identify malicious domains in real time; it presents classification, clustering, and anomaly detection modules and several case studies (C2/Trojan, malicious DDNS, strategically aged domains, typosquatting, and scam sites). The detector identified 170 emerging suspicious domains in May 2024 and the resulting signatures blocked roughly 374,000 malicious DNS requests per day, with listed IOCs including run.sh, biillpi.com, robotatten.com, pococo.cc, comcadt.net, carollewis.network, and a malicious URL path.