DGA Host Name Detection via Character Frequency Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for detecting malicious host names generated by domain generation algorithms (DGAs) rely heavily on string matching and require large DNS query data sets, making it difficult to identify unknown threats and often resulting in false positives, especially since they focus on group-based differentiation rather than individual host names.
Innovation Solution
A user-centric approach that utilizes user behavior logs to detect DGA-generated host names by analyzing the randomness of character composition and incorporating a filtering process to reduce false alarms, using string matching and grouping schemes to identify potentially malicious host names directly alerting at-risk end users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blacklist approach and string matching are used for DGA detection, then known malicious host names can be blocked, but unknown DGA-generated threats cannot be identified and false positives increase
Solution Approach 1:
The patent transforms the detection approach by changing parameters from exact string matching to statistical analysis of character frequency distributions. Instead of comparing host names against known malicious patterns, the system analyzes the probabilistic occurrence of character pairs (bigrams) and deviations from expected linguistic patterns, enabling detection of novel DGA-generated domains without relying on prior knowledge of specific malicious host names.
Solution Approach 2:
The patent replaces the mechanical string matching system with a statistical modeling system. Instead of using rigid pattern matching algorithms that compare host names against predefined blacklists, the system employs probabilistic models that calculate likelihoods based on character frequency distributions and linguistic patterns, allowing flexible adaptation to unknown threats while maintaining detection reliability.
2Measurement precision
If large quantity of DNS query data from Internet service provider is used for detection, then entity behind robot network can be identified, but data availability becomes limited and system complexity increases
Solution Approach 1:
The patent extracts the essential detection capability from the complex ISP-level DNS query data collection system. Instead of requiring access to large-scale DNS query logs from Internet service providers, the invention extracts and applies character frequency distribution analysis directly to individual host names, eliminating the need for extensive data collection infrastructure while preserving the core detection precision.
Solution Approach 2:
The patent enables each endpoint or local system to perform DGA detection independently using its own observed host name data. Instead of relying on centralized ISP-level DNS query collections, the system allows local devices to analyze their own accessed host names using character frequency statistics, making the detection capability self-sufficient and eliminating complex data sharing infrastructure requirements.
3Productivity
If group-based differentiation is used to distinguish DGA host names from benign host names, then classification can be performed, but individual host name detection accuracy decreases and false positives increase
Solution Approach 1:
The patent applies local quality analysis by focusing detection on specific local characteristics of individual host names, particularly character pair (bigram) frequency distributions within each host name. Instead of relying on group-level statistical properties that average out individual anomalies, the system examines local linguistic patterns and character sequences within each host name, enabling precise identification of DGA-generated domains while maintaining high classification throughput.
Data Source
AI summary
Host name raw data from access logs of computers is grouped into distinct groups. At least one feature, an alphanumeric or alphabetic-only digest, is extracted from each group and its characters are ordered depending upon their frequency of use. Sampling is performed upon host names from a database of known normal host names to generate groups of randomly selected host names. Similar digests are also extracted from these groups. The digest from the raw data is compared to each of the digests from the normal host names using a string matching algorithm to determine a value. If the value is above a threshold then it is likely that the host names from the raw data group are domain-generated. The suspect host names are used to reference the raw data access log in order to determine which user computers have accessed these host names and these user computers are alerted.