Time-Based DGA Malware Detection via DNS Query Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware using Domain Generation Algorithms (DGAs) evades detection by sending random DNS queries, making it difficult for security software to identify Command & Control (C&C) server communications, as these queries are not recognized by reputation databases and often result in NXDOMAIN responses.
Innovation Solution
A time-based approach is employed to detect DGA-based malware communications by analyzing DNS queries within short intervals, identifying potentially anomalous queries, and differentiating them from benign ones based on frequency and response patterns, assuming most queries will be to unresolvable domains and using assumptions about domain name generation to identify malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional reputation database methods are used to detect malware communications, then detection of known C&C servers is improved, but detection of DGA-based malware is worsened because random domain names are not recognized by reputation databases
Solution Approach 1:
The patent changes the detection parameter from domain reputation (static) to query frequency and temporal patterns (dynamic). By monitoring the rate of DNS queries and analyzing time-based patterns, the system can detect DGA malware regardless of whether the generated domains appear in reputation databases, thus resolving the contradiction between detecting known threats and adapting to new variants.
Solution Approach 2:
The system transitions from static reputation-based detection to dynamic behavior-based detection. By continuously monitoring DNS query rates and temporal patterns, the system adapts to detect both known and unknown malware variants, improving both reliability and adaptability simultaneously.
2Measurement precision
If DNS queries are analyzed individually, then false positives are reduced, but detection capability is worsened because individual queries appear benign even when part of a malicious pattern
Solution Approach 1:
The patent merges individual DNS query analyses by grouping queries within time windows and analyzing them collectively. This allows the system to identify malicious patterns (high query rates, multiple NXDOMAIN responses) while maintaining precision by using configurable thresholds and time-based context, thus resolving the contradiction between individual query precision and pattern-based detection reliability.
3Object-affected harmful factors
If security software blocks all suspicious DNS queries, then malware communications are prevented, but legitimate traffic is worsened by causing false positives and disrupting normal operations
Solution Approach 1:
The system uses feedback mechanisms by monitoring DNS query responses (particularly NXDOMAIN responses) and adjusting detection sensitivity based on observed patterns. This allows legitimate high-volume DNS traffic to pass through while blocking malicious patterns, resolving the contradiction between blocking malware and maintaining legitimate traffic flow.
Data Source
AI summary
A technique includes processing domain name system queries generated by a host to identify a subset of the queries for which domain names were not resolved. The technique includes using a time-based analysis to detect domain generation algorithm-based malware communications by the host, including detecting malicious communications by the host based at least in part on a number of the queries of the identified subset and a time span within which the queries of the subset were generated.