Malicious Domain Detection in Real-World Academic DNS Traffic: A Machine-Learning Approach

Guilherme Romanholo Bofo presents a hybrid malicious-domain detection system deployed at São Paulo State University (UNESP), combining open-source threat-intelligence feeds with a lightweight machine-learning classifier to analyze more than 20 million DNS queries daily. Using results from offline testing and a year-long production deployment, the talk explores how machine learning can identify suspicious domains missed by traditional blocklists, while highlighting the challenges of false positives, incomplete validation data, and class imbalance. The findings demonstrate the potential of machine learning as an early-warning and threat-triage tool rather than an autonomous blocking solution.