Fast flux attack engine for benchmarking AI-based DNS security systems

Fast flux is a DNS-based cyberattack technique that rapidly changes the IP addresses associated with a single domain to evade detection. While AI-based detection methods have been increasingly effective, limitations persist due to the dynamic and evasive nature of fast flux networks. This study presents a benchmarking framework using multiple machine learning classifiers, such as Decision Tree, Random Forest, Gradient Boosting, and Support Vector Machine, which are trained on real DNS data. The system evaluates performance against key features such as TTL values, IP churn rate, and number of name servers. This work provides a foundational dataset and comparative performance metrics to support future research in AI-driven DNS security.