Deep Learning DGA Detection via DNS Stream Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting Domain Generation Algorithms (DGAs) are inadequate as they rely on binary classification, hand-engineered features, and are unable to effectively identify new variants or provide contextual information, leading to high false positive rates and limited scalability.
Innovation Solution
A system utilizing a deep learning classifier, series filter-classifier, autoencoder-classifier, frequency spectrum analyser, and finding successful resolutions modules to classify and prioritize DNS records, identifying DGA characteristics, periodic behavior, and resolving to Command and Control servers without hand-engineered features or rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If binary classification methods with hand-engineered features are used to detect DGAs, then the detection process is simple and fast, but the detection accuracy is low and false positive rates are high
Solution Approach 1:
The patent replaces traditional mechanical feature engineering and rule-based classification with deep learning models (CNN, LSTM, Transformer) that automatically learn features from raw DNS query data. This substitution enables the system to achieve high detection accuracy without sacrificing processing speed, as the neural networks can process multiple features in parallel during inference.
Solution Approach 2:
The patent transforms the detection approach by changing from fixed hand-engineered features to dynamic learned representations. The system uses multiple deep learning architectures that automatically adapt feature extraction parameters based on the input data patterns, allowing it to capture complex DGA behaviors that static features cannot detect, thereby improving accuracy while maintaining efficiency through optimized model architectures.
2Ease of manufacture
If traditional detection methods are used, then the system is easy to implement, but it cannot identify new DGA variants or provide contextual information
Solution Approach 1:
The patent implements dynamic feature learning through deep neural networks that continuously adapt to new DGA patterns. The models are trained on diverse datasets and can dynamically adjust their feature extraction and classification strategies based on the input data, enabling detection of novel DGA variants without requiring manual rule updates. The system's architecture allows for easy retraining and adaptation to new threats.
Solution Approach 2:
The patent creates a universal detection framework that combines multiple deep learning models (CNN for spatial features, LSTM for temporal sequences, Transformer for attention-based patterns) into a single system. This multi-functional architecture can detect various DGA types (character-based, algorithm-based, hybrid) and provides rich contextual information including feature importance scores, prediction confidence, and temporal patterns, all while maintaining a unified implementation structure.
3Measurement precision
If comprehensive analysis of all DNS records is performed, then detection accuracy improves, but processing time and computational resources increase significantly
Solution Approach 1:
The patent segments the DNS query analysis into multiple independent processing streams handled by different deep learning models. Each model (CNN, LSTM, Transformer) processes specific aspects of the data in parallel, allowing comprehensive feature extraction without sequential bottlenecks. The system divides the analysis into feature extraction, model inference, and result aggregation stages, enabling efficient processing while maintaining high detection accuracy through multi-perspective analysis.
4Measurement precision
If multiple deep learning models are used for comprehensive analysis, then detection accuracy and contextual information improve, but system complexity increases
Solution Approach 1:
The patent merges multiple deep learning models into a unified detection pipeline where CNN, LSTM, and Transformer models work together synergistically. The system combines their outputs through a fusion layer that aggregates features from different temporal and spatial perspectives. This merging approach maintains high detection accuracy while reducing overall system complexity compared to running separate independent systems, as the models share data preprocessing and result integration infrastructure.
Data Source
AI summary
System and method for detecting domain names that exhibit Domain Generation Algorithm (DGA) like behaviours from a stream of Domain Name System (DNS) records. In particular, this document describes a system comprising a deep learning classifier (DL-C) module for receiving and filtering the stream of DNS records before the filtered DNS records, which have been determined to possess domain names that exhibit DGA behaviour are provided to a series filter-classifier (SFC) module. The SFC module then groups the records into various series based on source IP, destination IP and time. For each series, it then filters away records that do not exhibit the dominant DGA characteristics of the series. Finally, for each series, it makes use of the remaining DNS records' timestamps to generate a time series of DGA occurrences and then, using this time series of occurrences, determine the number of DGA bursts throughout the time period of analysis.