DGA Detection via Perplexity Score Categorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to detect domain generation algorithms (DGAs) in real-time with high precision, as they require prior identification and cannot store all variants, leading to difficulties in blocking malicious DNS queries effectively.
Innovation Solution
The method involves categorizing DNS queries based on a perplexity score using a Markov model, grouping similar queries, and maintaining a blocklist to block subsequent queries from client devices exhibiting DGA behavior, thereby identifying and blocking DGA-generated queries in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional DGA detection methods are used, then prior identification is required, but real-time detection capability is lost
Solution Approach 1:
The system performs preliminary actions by analyzing DNS query characteristics (perplexity scores, domain name patterns) in real-time before actual C2 communication occurs. The Markov model calculates perplexity scores and identifies DGA-generated domains proactively, enabling detection before the malware successfully communicates with the C2 server, thus resolving the contradiction between detection precision and response time.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring DNS query patterns, comparing perplexity scores against thresholds, and updating blocklists based on observed DGA behavior. This feedback loop enables the system to adapt to evolving DGA techniques while maintaining real-time detection capability, addressing both precision and timing requirements.
2Reliability
If all DGA domain variants are stored for detection, then detection completeness is improved, but storage capacity requirements increase
Solution Approach 1:
The system extracts only the essential characteristics of DGA domains (perplexity scores, domain name patterns, structural features) rather than storing complete domain variants. By extracting and analyzing these key features through the Markov model, the system achieves reliable detection without requiring storage of all possible DGA variants, thus resolving the contradiction between detection reliability and storage requirements.
Solution Approach 2:
The system changes the approach from storing complete domain names to storing and analyzing parameterized characteristics (perplexity scores, domain structure parameters). This parameter transformation enables the system to detect DGA domains based on their mathematical properties rather than storing every possible variant, reducing storage needs while maintaining detection reliability.
3Object-affected harmful factors
If DNS queries are blocked based on domain characteristics, then C2 communication is prevented, but legitimate traffic may be affected
Solution Approach 1:
The system applies local quality by analyzing specific characteristics of domain names (perplexity scores calculated from Markov models, specific pattern matches) rather than using broad blocking rules. This localized analysis allows the system to distinguish between legitimate domains and DGA-generated domains based on their unique lexical and structural properties, preventing C2 communication while minimizing false positives.
Solution Approach 2:
The system replaces simple mechanical blocking mechanisms with a sophisticated statistical analysis approach using Markov models and perplexity calculations. This substitution enables more intelligent decision-making that considers the probabilistic characteristics of DGA domains versus legitimate domains, reducing false positives while maintaining effective C2 prevention.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach allows for efficient and scalable detection and blocking of DGA-generated DNS queries, reducing the risk of C2 communication and data exfiltration by identifying unique lexical characteristics and query behavior patterns.
Implementation Method 1
categorizing a plurality of domain name system (DNS) queries received from a client device based on a perplexity score
Data Source
AI summary
A method of detecting a domain generation algorithm (DGA) may include categorizing a plurality of domain name system (DNS) queries received from a client device based on a perplexity score to obtain a group of categorized DNS queries. The method may further include verifying that the DNS queries correspond to a number of unique qualified names (qnames) or fully quantified domain names (FQDNs) within the group of categorized DNS queries. The method may further include transmitting to a DGA cache a number of entries including an identification of the client device transmitting the DNS queries and a perplexity score, the identification of the client device and the perplexity score defining a family of DNS queries that are produced by the DGA. The method may further include blocking subsequent DNS queries from the client device based on entries within a blocklist.