Algorithm-Generated Domain Detection via Statistical Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware authors are developing sophisticated Domain Generation Algorithms (DGAs) that generate pseudo-random Command and Control (C&C) domains, making it difficult for defenders to detect and blacklist algorithm-generated domains (AGDs) in a timely manner, as these domains are used briefly and often rely on benign services for seed values, evading traditional DNS blacklisting approaches.
Innovation Solution
A system that monitors and categorizes domain names requested by internal hosts, using curated data and active services to determine if they match known suspicious or classified domains, assigning analysis points and generating a certainty score for reporting, which can be used by human experts or machine learning schemes to identify potential C&C communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS blacklisting approaches are used to block C&C domains, then domain communication can be blocked, but algorithm-generated domains evade detection by using pseudo-random generation and short usage periods
Solution Approach 1:
The system performs preliminary analysis of domain name characteristics using statistical models before blacklisting is needed. By analyzing patterns in domain generation algorithms upfront and maintaining profiles of suspicious domain characteristics, the system can identify and block AGDs before they are actively used for C&C communication, making preliminary domain characterization and pattern analysis
Solution Approach 2:
The patent replaces traditional mechanical DNS blacklisting with a statistical analysis system that uses machine learning models and pattern recognition. Instead of relying on predefined blacklists, the system uses statistical characteristics of domain names (length, character distribution, entropy) to automatically identify and block algorithm-generated domains, substituting automated statistical analysis for manual blacklist maintenance
2Measurement precision
If reverse engineering is performed to predict AGDs beforehand, then detection accuracy may improve, but the process is difficult and time consuming
Solution Approach 1:
The system enables self-service detection by automatically analyzing domain name statistical characteristics without requiring manual reverse engineering. The statistical models autonomously identify patterns in domain generation algorithms and predict future AGDs by analyzing existing domain characteristics, eliminating the need for time-consuming manual reverse engineering while maintaining high detection accuracy
Solution Approach 2:
The patent changes the approach from analyzing malware code structure to analyzing statistical parameters of domain names themselves. By focusing on measurable parameters such as domain length, character frequency distribution, and entropy values, the system can predict AGDs through statistical analysis rather than reverse engineering, significantly reducing analysis time while maintaining prediction accuracy
3Adaptability or versatility
If DGA uses late-arriving random seed values from benign services, then detection becomes more difficult, but this delays defender's ability to generate and blacklist AGDs
Solution Approach 1:
The system performs preliminary statistical analysis of domain names generated by DGAs, establishing baseline characteristics and patterns before the actual C&C communication occurs. By pre-characterizing the statistical properties of AGDs and setting up automated monitoring for these patterns, the system can detect and respond to new AGDs rapidly even when seed values arrive late, making early statistical profiling and pattern establishment
Solution Approach 2:
The system implements continuous feedback loops where detected AGD patterns are fed back into the statistical models to improve future detection accuracy. When new algorithm-generated domains are identified, their characteristics are analyzed and used to refine the statistical profiles, creating a self-improving system that adapts to new DGA variations and reduces response time over time
Data Source
AI summary
A method and system for detecting algorithm-generated domains (AGDs) is disclosed wherein domain names requested by an internal host are categorized or classified using curated data sets, active services (e.g. Internet services), and certainty scores to match domain names to domain names or IP addresses used by command and control servers.