Detecting Botnets via DNS Query Failure Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting domain-flux botnets is labor-intensive and requires disassembling malware binaries, providing only a point solution, as they abuse DNS infrastructure to add resiliency to their command and control communication.
Innovation Solution
A method and system that analyze failed DNS queries using a pre-determined clustering algorithm to generate clusters of effective second-level domain names, calculate statistical characteristics, and assign a malicious status to client nodes based on predetermined criteria, effectively identifying malicious nodes in a network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If domain-flux botnets use multiple domain names with DGA to contact C&C servers, then the resiliency and reliability of command and control communication is improved, but the complexity of detecting and measuring malicious activity increases
Solution Approach 1:
The patent segments the detection problem by analyzing individual DNS query failure patterns rather than requiring complete botnet identification. Each failed DNS query is examined independently for characteristics of DGA-generated domains, allowing detection of malicious activity through multiple small indicators rather than one complex signature.
Solution Approach 2:
Instead of trying to identify successful C&C communications, the patent inverts the approach by focusing on failed DNS queries. Malicious bots attempting to resolve DGA domains generate predictable failure patterns, and by analyzing these failures rather than successes, the system detects botnet activity that would otherwise be hidden among legitimate traffic.
2Measurement precision
If traditional methods disassemble malware binaries to detect DGAs, then detection precision is improved, but the productivity and ease of operation deteriorates due to labor-intensive effort
Solution Approach 1:
The system performs self-service detection by automatically analyzing DNS query failure patterns without requiring manual malware analysis. The automated processing of DNS failures replaces labor-intensive binary disassembly, maintaining detection precision while dramatically improving productivity through systematic, scalable automated analysis.
Solution Approach 2:
The patent replaces the mechanical process of manual binary disassembly and DGA identification with an automated system that analyzes DNS query failures. This substitution transforms a labor-intensive manual process into an automated computational process that can handle large volumes of data efficiently while maintaining detection accuracy.
3Adaptability or versatility
If botnets use Domain Generation Algorithms to create multiple domain names, then the adaptability of C&C communication is improved, but the loss of time for detecting malicious patterns increases
Solution Approach 1:
The system performs preliminary action by continuously monitoring and analyzing DNS query failure patterns in real-time. Rather than waiting for botnet activity to manifest in other ways, the system proactively detects malicious patterns through DNS failures, enabling early identification and response to botnet activity before it can cause broader harm.
Data Source
AI summary
A method for detecting a malicious node in a network. The method includes obtaining a plurality of failed domain name service (DNS) queries from the network, wherein each of the plurality of failed DNS queries is initiated from a client node of the network and comprises an effective second-level domain (eSLD) name, generating, by a computer processor and using a pre-determined clustering algorithm, a cluster from a plurality of eSLD names comprising the eSLD name of each of the plurality of failed DNS queries, wherein the cluster comprises a portion of the plurality of eSLD names that is selected based on the pre-determined clustering algorithm, determining, by the computer processor and using a pre-determined formula, a score representing statistical characteristics of the cluster, and assigning, in response to the score meeting a pre-determined criterion, a malicious status to the client node.