DNS Beaconing Detection via TTL and Transmission Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in detecting malicious beaconing without generating false positives, as malicious beaconing can mimic legitimate network traffic and evade detection through various techniques such as jittering, size variations, and hosting within legitimate cloud providers.
Innovation Solution
An event-based data intake and query system that processes and indexes machine data using a late-binding schema, allowing for flexible extraction and analysis of events, including the detection of DNS beaconing through time-series TTL analysis, which generates vectors to differentiate between malicious and non-malicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current detection technologies are used to identify malicious beaconing, then some malicious connections can be detected, but a large number of false positives are generated
Solution Approach 1:
The patent changes the detection parameters from simple beacon interval timing to a multi-dimensional analysis including TTL values, transmission timing, packet size, and frequency. By analyzing multiple parameters simultaneously rather than relying on a single threshold, the system achieves better differentiation between malicious and legitimate traffic, reducing false positives while maintaining detection accuracy
Solution Approach 2:
The patent introduces an intermediary analysis layer that examines DNS query characteristics (TTL values, response times, query patterns) as intermediate indicators before making a final maliciousness determination. This intermediary analysis provides additional context and nuance that helps distinguish true beacons from legitimate DNS traffic, thereby reducing false positives
2Measurement precision
If detection methods are made more sensitive to catch all malicious beaconing, then detection coverage improves, but false positives increase
Solution Approach 1:
The patent segments the detection process into multiple independent analysis components: TTL analysis, timing analysis, frequency analysis, and size analysis. Each component evaluates a specific aspect of the DNS traffic independently, and the final determination is made by synthesizing results from all segments. This segmentation allows comprehensive coverage while maintaining control over false positive generation through modular, targeted analysis
3Measurement precision
If traditional beacon detection methods are used, then periodic transmissions can be identified, but evasion techniques like jittering and size variations fail to be detected
Solution Approach 1:
The patent applies dynamic analysis that adapts to varying transmission patterns. Instead of assuming fixed periodic intervals, the system dynamically adjusts its analysis to detect variations in timing, size, and frequency. The detection methodology evolves with each observed transmission, allowing it to identify malicious patterns even when they employ jittering or size variations to evade static detection rules
4Measurement precision
If comprehensive analysis of all network traffic is performed, then detection accuracy improves, but processing time and system complexity increase
Solution Approach 1:
The patent extracts and focuses analysis on specific, high-value DNS traffic characteristics (TTL values, response times, query frequencies) rather than analyzing all aspects of network traffic. By selectively extracting only the most discriminative features for analysis, the system achieves high detection accuracy while minimizing processing time and computational overhead
Data Source
AI summary
The disclosure provides implementations for determining whether domain name server (DNS) beaconing is present within a communication session. Some implementations provide a method that includes multiple analyses directed to analyzing each of a time-to-live (TTL) run length distribution for a plurality of DNS records within the communication session and analyzing whether the communication is comprised of at least a threshold number of transmissions. As used in the analyses, the communication session may be comprised of transmissions between a first source device and a first DNS. When DNS beaconing is detected within the communication session, some implementations of the disclosure provide for generating an alert to an administrator or other user.