Botnet Domain Detection via Polytope Region Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Botnets pose a challenge due to their dynamic domain generation algorithms (DGAs) that create numerous potential communication domains, making it difficult to disrupt the communication link between infected devices and command and control software.
Innovation Solution
A method for detecting botnet domains involves monitoring network traffic, identifying suspect clients based on repeated domain queries, determining client activity information, and using polytope regions to compare domains queried by suspect clients to identify botnet domains, which are then blocked to disrupt botnet control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If domain generation algorithms (DGA) are used to create numerous potential communication domains, then the botnet can maintain communication channels with infected devices, but it becomes difficult to shut down the botnet and sever the communication link
Solution Approach 1:
The patent segments the large set of DGA-generated domains into smaller polytope regions based on client activity information. Each polytope region represents a subset of domains with similar characteristics, making it feasible to analyze and detect botnet domains among the vast number of potential domains generated by DGA.
Solution Approach 2:
The patent transforms the domain detection problem by changing parameters from direct domain analysis to polytope region analysis. It uses client activity information (number of clients, identities, total domains queried, proportion over time windows) to define polytope regions, thereby converting an intractable search problem into a manageable geometric classification problem.
2Extent of automation
If the botnet master uses command and control software hosted on botnet domains, then remote control of infected devices is enabled, but the dynamic nature of botnet domains makes it difficult to block communication
Solution Approach 1:
The patent performs preliminary analysis of client activity information before botnet domains become active threats. By monitoring and analyzing domain query patterns over time windows, the system identifies suspect clients and constructs polytope regions in advance, enabling proactive detection and blocking of botnet domains before they can establish stable communication channels.
Solution Approach 2:
The patent implements feedback through continuous monitoring of client activity information. The system repeatedly queries domains, updates client activity data (number of clients, identities, total domains queried, proportion over consecutive time windows), and adjusts polytope regions based on observed patterns. This feedback loop enables the system to adapt to changing botnet behavior and maintain reliable detection despite domain dynamics.
3Productivity
If a large number of domains are queried by infected devices, then communication with command and control software is maintained, but identifying which specific domains are botnet domains becomes increasingly difficult
Solution Approach 1:
The patent merges multiple individual domain queries into a unified polytope region analysis. Instead of evaluating each domain independently, it combines client activity information across multiple domains and time windows to construct polytope regions. This merging approach preserves measurement precision by considering the collective behavior pattern rather than isolated domain queries, enabling accurate identification of botnet domains even when a large volume of domains are queried.
Data Source
AI summary
A method and an apparatus for detecting botnet domains is described. In one embodiment, the method includes monitoring network traffic associated with a plurality of clients in a network. Based on the monitoring, information related to a plurality of domains that are queried is stored. The method includes identifying one or more suspect clients in the network based on the stored information and determining a subset of suspect domains based on the stored information related to the domains queried by the suspect clients. The method can include determining client activity information and using the client activity information to determine a polytope region for a client. The method includes comparing each suspect domain to the polytope region and associating a domain with a group of blocked domains if the domain falls within the polytope region.