DGA Malware Detection via DNS and Hostname Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DGA detection methods are prone to false positives due to factors like abbreviations and language differences, requiring external intelligence and being ineffective against dynamic domain name generation algorithms used by modern malware, which makes it difficult to detect command and control servers in computer networks.
Innovation Solution
A security device in a computer network uses a DNS model to detect abnormally high DNS requests for potential DGA searching activity and applies a hostname-based classifier for DGA domains associated with IP addresses in network traffic, correlating searching and communication activities to identify DGA-performing malware with high precision without relying on external intelligence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistical modeling of character distributions is used for DGA detection, then detection capability is improved, but false positives increase due to abbreviations and language differences
Solution Approach 1:
The patent combines multiple detection techniques including statistical modeling, white-listing, black-listing, WHOIS registration date analysis, and NXDOMAIN request tracking into a unified detection system. This multi-faceted approach allows the system to cross-validate findings and reduce false positives while maintaining high detection capability.
Solution Approach 2:
The patent introduces external intelligence sources as intermediaries, including WHOIS registration databases, known malware domain feeds, and NXDOMAIN response data. These external sources provide contextual information that helps distinguish legitimate abbreviations from actual DGA-generated domains, reducing false positives.
2Reliability
If external intelligence sources are used to reduce false positives, then detection reliability is improved, but system complexity increases
Solution Approach 1:
The patent creates a multi-functional detection system where a single platform performs statistical analysis, white-listing, black-listing, WHOIS queries, and NXDOMAIN tracking. This universal system reduces the need for multiple separate tools and manages complexity through integration rather than multiplication of components.
Solution Approach 2:
The system automatically queries external intelligence sources and processes their responses without manual intervention. The detection platform self-manages the complexity of integrating multiple data sources by automating data collection, processing, and correlation, reducing the operational burden despite increased system capabilities.
3Measurement precision
If multiple detection steps are implemented, then detection comprehensiveness is improved, but each step becomes a potential source of false positives
Solution Approach 1:
The patent implements feedback mechanisms where detection results from one step inform subsequent steps. For example, domains identified as potential DGAs through statistical modeling are then cross-checked against white-lists and black-lists, and their WHOIS registration dates are analyzed. This feedback loop allows the system to refine detections and eliminate false positives at each stage.
Solution Approach 2:
The detection process is segmented into distinct analytical steps: statistical character distribution analysis, white-list matching, black-list matching, WHOIS registration date verification, and NXDOMAIN request pattern analysis. Each segment focuses on a specific aspect of DGA detection, allowing the system to maintain comprehensiveness while managing false positives through specialized analysis at each stage.
Data Source
AI summary
In one embodiment, a security device in a computer network detects potential domain generation algorithm (DGA) searching activity using a domain name service (DNS) model to detect abnormally high DNS requests made by a host attempting to locate a command and control (C&C) server in the computer network. The server device also detects potential DGA communications activity based on applying a hostname-based classifier for DGA domains associated with any server internet protocol (IP) address in a data stream from the host. The security device may then correlate the potential DGA searching activity with the potential DGA communications activity, and identifies DGA performing malware based on the correlating, accordingly.