DNS Co-occurrence Pattern Detection for Malware Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to effectively detect suspicious software, particularly malware, that uses non-existent domains for malicious activities, as they require reverse engineering of domain generation algorithms, which is complex and inefficient.
Innovation Solution
A system and method that analyze name resolution requests from multiple name servers using a sliding time window to identify co-occurring non-existent domains, employing techniques like frequent pattern trees and breadth-first searches to detect malware by identifying clusters of requests for non-existent domains, and trigger remediation measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reverse engineering of domain generation algorithms is used to detect malware, then detection capability is improved, but device complexity and time consumption increase significantly
Solution Approach 1:
Instead of reverse engineering domain generation algorithms to understand malware behavior, the patent inverts the approach by analyzing name resolution requests to detect patterns of non-existent domain queries. This indirect method identifies malware through its communication patterns rather than decoding its domain generation logic, significantly reducing complexity while maintaining detection effectiveness
Solution Approach 2:
The patent introduces name resolution requests as an intermediary indicator to detect malware. Rather than directly analyzing malware code or domain generation algorithms, the system uses DNS query patterns as a mediator to infer malware presence, simplifying the detection process while improving reliability
2Reliability
If reverse engineering of domain generation algorithms is used to detect malware, then detection capability is improved, but time consumption increases significantly
Solution Approach 1:
The patent performs preliminary analysis of name resolution requests to identify patterns of non-existent domain queries before full malware detection is required. By pre-processing and monitoring DNS query patterns, the system prepares detection data in advance, reducing the time needed for actual malware identification while maintaining high detection capability
Solution Approach 2:
The patent extracts specific indicators from name resolution requests—particularly patterns of queries for non-existent domains—and uses only these extracted features for detection. This selective extraction avoids the time-consuming process of complete reverse engineering while maintaining effective detection capability
3Device complexity
If traditional detection methods are used, then device complexity is reduced, but detection precision for malware using non-existent domains deteriorates
Solution Approach 1:
The patent changes the detection parameter from analyzing domain generation algorithms to analyzing the existence status of queried domains. By focusing on whether domains exist rather than how they are generated, the system maintains low complexity while achieving high detection precision for malware using non-existent domains
Data Source
AI summary
Techniques for inferring the existence of suspicious software by detecting multiple name server requests for the same sets of non-existent domains. Implementations can allow for detecting the existence of malware or other suspicious software without requiring reverse engineering of the malware's domain generation algorithm.