DGA IP Detection via DNS Stream Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches fail to accurately and efficiently identify Domain Generation Algorithm (DGA) behavior on networks, and determine if a host device sending DNS queries to non-existent domains is infected with DGA malware.
Innovation Solution
A system and method that involves receiving a DNS stream, classifying it using a machine learning classifier to identify DGA-generated domains, performing user behavior profiling by clustering domains with the same source IP address, and generating a verdict to identify compromised IP addresses associated with DGA malware attacks, which can block or quarantine the source.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional DNS query monitoring is used to detect DGA malware, then all DNS queries are captured and analyzed, but this results in high false positive rates and inability to accurately identify compromised hosts
Solution Approach 1:
The patent segments the DNS query monitoring process by source IP address, creating separate analysis streams for each host. This segmentation allows the system to focus on behavioral patterns specific to each source rather than analyzing all queries globally, thereby improving detection accuracy while reducing false positives caused by legitimate high-volume DNS traffic from single hosts.
Solution Approach 2:
The system dynamically adjusts detection thresholds and analysis parameters based on observed DNS query patterns from each source IP. Rather than using static rules, the system adapts to the specific behavior characteristics of each host, enabling accurate identification of DGA patterns while accommodating legitimate variations in DNS usage patterns across different hosts.
2Reliability
If comprehensive DNS stream analysis is performed on all queries, then potential DGA threats are captured, but this consumes excessive computational resources and time
Solution Approach 1:
The patent extracts and isolates DNS queries grouped by source IP address, separating the analysis workload into manageable segments. By extracting only the relevant queries from each source for detailed analysis rather than processing the entire DNS stream uniformly, the system maintains comprehensive threat detection capability while significantly reducing overall computational resource consumption and processing time.
Solution Approach 2:
The system applies partial analysis actions to DNS queries based on risk assessment. Rather than performing exhaustive analysis on every query, the system applies intensive analysis only to queries from sources exhibiting suspicious patterns, while applying lighter or no analysis to clearly benign traffic, thereby optimizing the balance between detection reliability and processing productivity.
3Quantity of substance
If DNS queries from multiple sources are analyzed together, then overall network traffic patterns are visible, but this masks the specific behavior of individual compromised hosts
Solution Approach 1:
The patent implements segmentation of the DNS query dataset by source IP address, organizing queries into distinct groups for analysis. This segmentation preserves the total quantity of DNS traffic data while enabling precise measurement of DGA-specific patterns for each individual source, preventing the masking effect that occurs when all queries are analyzed collectively.
Solution Approach 2:
The system applies local quality analysis by tailoring the detection criteria and analysis depth to each source IP's specific behavior patterns. Rather than applying uniform analysis across all sources, the system adjusts its detection approach to match the local characteristics of each host's DNS traffic, thereby achieving high precision in identifying DGA behavior specific to each compromised host while maintaining visibility of overall network traffic volume.
Data Source
AI summary
A system and method for locating DGA compromised IP addresses is provided. A domain name system (DNS) stream is received. The DNS stream is classified into DGA generated domains using a machine learning classifier to generate a classification output. User behavior profiling is performed to enhance the classification output. A verdict is generated based on the user behavior profiling of the classification output including identifying a compromised source IP address associated with a detected DGA malware attack.