Malware Detection via DNS Query Failure Rate Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection schemes struggle to effectively identify and block domain generation algorithms (DGAs) used by malware to evade tracking and blocking, as they rely on static characteristics and pattern recognition, which are easily circumvented by attackers who can generate numerous domain addresses.
Innovation Solution
A malware detection method that monitors DNS query requests and replies across all processes, counts failure rates, and determines malware based on excessive failure rates within a predetermined time, allowing for real-time identification and isolation of malicious activity, regardless of changes in the DGA algorithm.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If conventional static characteristic detection schemes are used to identify malware, then the detection method is simple to implement, but the detection effectiveness deteriorates because attackers can easily circumvent pattern recognition by generating numerous domain addresses through DGA
Solution Approach 1:
The patent changes the detection parameter from static code patterns to dynamic DNS query behavior characteristics. Instead of analyzing malware code patterns that attackers can evade, the system monitors DNS query frequency, domain name length, and query timing patterns to detect DGA-generated domains, thereby improving detection effectiveness while maintaining implementation simplicity
Solution Approach 2:
The system implements feedback by continuously monitoring DNS query results and using the failure rate information to identify potential DGA activity. When a high proportion of DNS queries return failure or NXDOMAIN responses, the system flags the associated process as suspicious, creating a closed-loop detection mechanism that adapts to attacker behavior
2Adaptability or versatility
If malware generates hundreds to thousands of domain addresses daily through DGA, then the attacker can hide the real domain address among many fake addresses, but this increases the complexity of tracking and blocking efforts
Solution Approach 1:
The patent extracts the essential characteristic of DGA activity from the overwhelming number of domain queries by focusing on the failure rate metric. Instead of attempting to track or block each individual domain address generated by DGA, the system extracts and analyzes the proportion of failed DNS queries, which serves as a reliable indicator of DGA usage without requiring complex tracking of thousands of domains
Solution Approach 2:
The system transitions from static pattern matching to dynamic behavior analysis by monitoring DNS query patterns in real-time. It observes the rate and timing of DNS queries, the proportion of failures, and changes in domain name characteristics, allowing the detection system to adapt to evolving DGA techniques without requiring updates to static signature databases
3Ease of operation
If static pattern recognition is used for DGA detection, then the detection scheme is straightforward, but it fails to detect new DGA algorithms that attackers develop to evade detection
Solution Approach 1:
The patent implements dynamic detection by monitoring behavioral characteristics of DNS queries rather than relying on static code patterns. The system continuously observes DNS query frequency, domain name length distribution, and failure rates, allowing it to detect new DGA algorithms based on their operational behavior rather than their implementation details, thus maintaining detection effectiveness against evolving threats
Solution Approach 2:
The detection system achieves universality by identifying a common behavioral pattern (high DNS failure rate) that applies across different DGA algorithms and malware types. This single detection mechanism can identify various DGA implementations regardless of their specific code structures or generation methods, providing broad detection coverage without requiring multiple specialized detection schemes
Data Source
AI summary
A malware detection method for preventing execution of malware, a method for detecting a domain generation algorithm, and a computer device therefor are provided. The malware detection method includes monitoring, by a processor of a computer, domain name system (DNS) query requests for all processes and replies to the query requests and counting, by the processor, the number of times of failure DNS query requests per unit process and determining, by the processor, malware.