DNS Malware Detection via Graph Belief Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods struggle to effectively detect malicious domains and client addresses in DNS traffic, particularly in the presence of domain generation algorithms (DGAs) used by modern malware, which evade detection by constantly changing IP addresses and generating numerous domain names, making it difficult to distinguish legitimate from malicious traffic.
Innovation Solution
A deep learning model utilizing stacked autoencoders to determine priors for domains and client addresses, combined with belief propagation on a graph constructed from DNS traffic, to infer malware presence and trigger mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DNS detection methods are used, then the system is simple to implement, but it cannot effectively detect malicious domains using domain generation algorithms
Solution Approach 1:
The system segments the detection problem into multiple components: constructing a graph where vertices represent domains and client addresses, using stacked autoencoders to process different features separately, and applying belief propagation to infer malware presence. This segmentation allows complex detection to be broken down into manageable processing stages.
Solution Approach 2:
The patent introduces an intermediary graph structure that mediates between raw DNS traffic data and detection decisions. The graph visualizes relationships between domains and client addresses, serving as an intermediate representation that enables sophisticated analysis without directly processing all raw data at once.
2Adaptability or versatility
If domain generation algorithms are used by malware, then malware can evade detection by changing IP addresses, but this creates difficulty in distinguishing legitimate from malicious traffic
Solution Approach 1:
The system dynamically adapts to malware's changing behavior by continuously monitoring DNS traffic patterns and updating the graph structure in real-time. The stacked autoencoders learn from evolving traffic patterns, allowing the system to detect new DGA domains as they emerge rather than relying on static detection rules.
Solution Approach 2:
The belief propagation algorithm provides feedback by continuously updating malware probability estimates based on observed traffic patterns. When a domain or client address shows suspicious behavior patterns, the system reinforces these suspicions through iterative processing, making the detection system self-correcting and adaptable to evasive tactics.
3Measurement precision
If deep learning models with stacked autoencoders are used, then detection accuracy improves, but computational resources and processing time increase
Solution Approach 1:
The stacked autoencoders perform preliminary feature extraction and dimensionality reduction on DNS traffic data before it reaches the belief propagation algorithm. This preliminary processing consolidates and pre-processes the data, reducing the computational burden on subsequent analysis stages while maintaining detection accuracy.
Data Source
AI summary
In one embodiment, a device in a network constructs a graph based on Domain Name System (DNS) traffic in which vertices of the graph correspond to client addresses from the DNS traffic and domains from DNS traffic. The device uses stacked autoencoders to determine priors for the domains and client addresses. The device assigns the determined priors to the corresponding vertices of the graph. The device uses belief propagation on the graph to determine a malware inference from the graph. The device causes performance of a mitigation action when the malware inference from the graph indicates the presence of malware.