DGA Domain Detection via Segmented Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems face challenges in detecting and preventing malicious activities from domain generation algorithms (DGAs) due to the difficulty in identifying registered DGA-generated domain names, which are often masked by unregistered ones, leading to false positives and delayed detection.
Innovation Solution
A system and method that includes a traffic inspection engine and a DGA inspection engine, communicatively coupled via a message bus, to identify DGA-generated domains, verify their registration, and inspect subsequent network traffic sessions, allowing for timely detection and prevention of malicious activities by blocking traffic to registered DGA domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature or IP reputation-based security detection systems are used to detect DGA generated domains, then detection can be performed, but false positives increase and detection effectiveness decreases due to the large number of unregistered domains masking the registered ones
Solution Approach 1:
The system segments the detection process into two distinct phases: first identifying potential DGA generated domains through traffic inspection, then separately verifying their registration status. This segmentation allows the system to handle the large volume of unregistered domains efficiently while focusing verification resources on distinguishing the few registered malicious domains, thereby improving detection precision without increasing false positives
Solution Approach 2:
The system introduces an intermediary verification mechanism that acts as a bridge between initial domain identification and final malicious activity detection. This intermediary step validates whether identified DGA domains are actually registered, preventing false positives caused by unregistered domains and improving overall detection reliability
2Reliability
If all DGA generated domains are monitored and verified, then registered domains can be detected, but the time and computational resources required increase significantly
Solution Approach 1:
The system applies partial action by performing comprehensive verification only on domains identified as potential DGA generated domains, rather than verifying all domains in the network traffic. This selective approach maintains high detection accuracy for malicious domains while significantly reducing the time and computational resources required compared to monitoring all domains
Solution Approach 2:
The system performs preliminary identification of potential DGA generated domains using traffic inspection patterns before conducting the more resource-intensive verification step. This preliminary filtering action prepares the system by pre-identifying suspicious domains, allowing subsequent verification to focus only on relevant candidates and reducing overall detection time
3Speed
If a tightly integrated detection and prevention system is implemented, then response time to block malicious traffic improves, but system complexity increases
Solution Approach 1:
The system merges the detection engine and prevention system into a tightly integrated architecture where domain identification, verification, and traffic blocking operations work as a unified process. This merging enables real-time response by eliminating delays between detection and prevention actions, achieving fast response speed while managing complexity through coordinated integration of components
Data Source
AI summary
A non-transitory computer-readable medium having a program stored thereon that, when executed by one or more processors, directs a computing system to secure a communication network. The program comprises a traffic inspection engine, a domain generation algorithm (DGA) inspection engine, and a message bus communicationally coupling the traffic inspection engine and the DGA inspection engine. The traffic inspection engine is configured to identify if a traffic session containing a domain name system (DNS) request and/or response in a communication network includes a DGA generated domain and send information about the identified DGA generated domain to the DGA inspection engine via the message bus. The DGA inspection engine is configured to verify if the identified DGA generated domain is registered, and send information about the registered DGA domain to the traffic inspection engine via the message bus. The traffic inspection engine is further configured to inspect, using the information about the registered DGA generated domain, if a subsequent traffic session in the communication network contains the registered DGA generated domain.