Graph-Based DNS Stream Analysis for Dictionary DGA Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional DGA detection techniques are ineffective against dictionary-based DGAs (DDGAs) as they generate human-readable domains using wordlists, making it difficult to distinguish between benign and malicious domains, especially when contextual information is lacking or expensive to acquire.
Innovation Solution
The proposed solution involves a graph-based analysis of DNS data streams to identify intersections between domains and filter out natural language-related domains, allowing for the detection of malicious dictionaries and botnet activity without requiring contextual information, using a system that generates graphs from DNS data to detect domains generated by DDGAs and extract the underlying dictionary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional DGA detection techniques are used, then detection of random domain generation is improved, but detection of dictionary-based DGA (DDGA) fails because they generate human-readable domains using wordlists
Solution Approach 1:
The patent segments the DNS data stream into individual domains and constructs a graph where domains are nodes and shared substrings are edges. This segmentation allows the system to analyze domain relationships independently without requiring contextual information about the entire DNS stream, enabling detection of DDGA patterns through graph structure analysis rather than traditional domain-level inspection.
Solution Approach 2:
The patent transitions from analyzing domains in one dimension (individual domain characteristics) to analyzing them in a new dimension (graph-based relationship space). By representing domains as nodes and their shared substrings as edges in a graph, the system detects DDGA patterns through topological properties and community structures that are invisible in traditional domain analysis, thus achieving both precision and versatility.
2Measurement precision
If contextual information is acquired to improve detection accuracy, then detection performance improves, but system complexity and cost increase
Solution Approach 1:
The system performs self-service by automatically constructing the domain graph and identifying communities through unsupervised learning algorithms. The graph structure itself provides the necessary contextual information without requiring external data sources or manual configuration. The system extracts meaningful patterns from the raw DNS data through community detection algorithms, achieving high detection accuracy while maintaining low system complexity.
Solution Approach 2:
The patent introduces a graph structure as an intermediary between raw DNS data and detection results. This graph intermediary automatically captures relationships between domains through shared substrings, providing contextual information in a structured format that simplifies subsequent analysis. The graph serves as a mediator that transforms unstructured DNS data into a form suitable for community detection, reducing the need for complex external contextual information.
3Measurement precision
If graph-based analysis is performed on DNS data streams, then detection of malicious dictionaries and botnet activity is achieved, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary actions by pre-processing the DNS data stream to extract individual domains and identify shared substrings before constructing the full graph. This preliminary extraction of domain components and their relationships enables more efficient graph construction and community detection, reducing the computational burden during the main detection phase and allowing real-time or near-real-time analysis of DNS traffic.
Data Source
AI summary
Techniques for detection of algorithmically generated domains based on a dictionary are disclosed. In some embodiments, a system, process, and/or computer program product for detection of algorithmically generated domains based on a dictionary includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; generating a graph based on the DNS data stream; and identifying a malicious dictionary based on the graph.