Autoencoder Malicious Host Detection via DNS Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware developers employ dynamic DNS and convoluted techniques to prevent detection by using malicious DNS controllers, making it difficult for intrusion detection systems to identify malicious network references due to constantly changing hostnames and IP addresses.
Innovation Solution
A method using an autoencoder trained on hostnames from infected systems to identify malware servers by selecting symbol and symbol position tuples based on weighted interconnections, allowing for detection of infected systems attempting to communicate with malware servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic DNS and malicious DNS controllers are used by malware developers, then the ability to communicate with malware servers is maintained, but the detectability of infected systems increases
Solution Approach 1:
The patent replaces traditional mechanical signature-based detection methods with a neural network-based automated detection system. The neural network learns patterns in DNS queries and communications automatically, substituting manual rule-based approaches with an adaptive intelligent system that can detect malware communications even when hostnames and IP addresses change dynamically.
Solution Approach 2:
The patent changes the detection parameters from static signatures (specific hostnames, IP addresses) to dynamic pattern recognition. The neural network analyzes multiple parameters including query frequency, timing patterns, domain structure, and communication behavior, transforming the detection approach from fixed criteria to adaptive parameter-based identification.
2Adaptability or versatility
If hostnames and URLs are frequently changed to prevent detection, then the malware server remains accessible, but the complexity of maintaining communication increases
Solution Approach 1:
The patent creates simplified copies or representations of complex malware communication patterns. The neural network extracts essential features and creates a model that captures the behavior of malware communications without needing to track every specific hostname or URL change, reducing the complexity of detection while maintaining adaptability.
Solution Approach 2:
The patent develops a universal detection system that handles multiple types of malware communication methods through a single neural network framework. The system can detect various malware strains, communication protocols, and DNS manipulation techniques using the same underlying technology, reducing overall system complexity while maintaining broad adaptability.
3Difficulty of detecting and measuring
If each infected machine uses different URLs that resolve to the same malware server, then detection by IDS becomes difficult, but the coordination overhead increases
Solution Approach 1:
The patent implements continuous monitoring and analysis of DNS queries and network communications. Rather than periodic scanning, the neural network continuously processes data streams from multiple infected machines, maintaining constant detection capability that adapts to ongoing malware behavior without interruption or coordination delays.
Solution Approach 2:
The patent incorporates feedback mechanisms where detection results and analyzed patterns are continuously fed back into the neural network to improve detection accuracy. The system learns from each detected communication pattern and adjusts its detection criteria, creating a self-improving detection mechanism that reduces coordination overhead through automated learning.
Data Source
AI summary
A method for detecting malware software in a computer system includes accessing a plurality of hostnames for a malware server from a computer system infected with malware and attempting to communicate with the malware server, each hostname including a plurality of symbols in each of a plurality of symbol positions; training an autoencoder based on each of the plurality of hostnames, wherein the autoencoder includes: a set of input units for each possible symbol and symbol position in a hostname; output units each for storing an output of the autoencoder; and a set of hidden units smaller in number than the set of input units and each interconnecting all input and all output units with weighted interconnections, such that the autoencoder is trainable to provide an approximated reconstruction of values of the input units at the output units; selecting a set of one or more symbol and symbol position tuples based on weights of interconnections in the trained autoencoder; and identifying infected computer systems based on their attempted communication to hostnames having symbols in symbol positions consistent with the tuples in the set.