DNS Query Pattern Analysis for Malicious Domain Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware authors use sophisticated techniques to obfuscate their software, making it difficult for existing methods to detect and prevent malicious domains from communicating with command and control servers, especially when algorithmically generated domains are used, which are not easily identifiable by traditional blacklisting approaches.
Innovation Solution
Generating DNS signatures from DNS query patterns to identify malicious domains, which can be used by firewalls and security platforms to detect and block suspicious communications, even when domains change, by analyzing passive DNS data and using correlation coefficients to match patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional blacklisting approaches are used to identify malicious domains, then detection of known malicious domains is improved, but detection of algorithmically generated domains deteriorates
Solution Approach 1:
The patent transforms the detection approach from static domain name matching to dynamic pattern analysis by changing the parameters being monitored. Instead of checking against fixed blacklists, the system analyzes DNS query patterns, timing, frequency, and behavioral characteristics to identify malicious domains regardless of their names. This parameter transformation enables detection of algorithmically generated domains that would evade traditional blacklisting.
Solution Approach 2:
The patent replaces the mechanical blacklist matching system with a signal processing-based detection system. By treating DNS query sequences as signals and applying spectral analysis (Fourier transforms), the system substitutes simple string matching with sophisticated pattern recognition that can identify malicious behavior patterns even when domain names are dynamically generated.
2Reliability
If malware communication patterns are analyzed to detect malicious domains, then detection capability is improved, but complexity of the security system increases
Solution Approach 1:
The patent introduces DNS query pattern analysis as an intermediary layer between the malware communication and the detection system. Rather than directly analyzing malware behavior or network traffic, the system uses DNS queries as an intermediate observable that reveals malicious communication patterns. This intermediary approach improves detection reliability while keeping the system complexity manageable by focusing on a specific, observable aspect of malware behavior.
Solution Approach 2:
The patent extracts specific relevant features from the complex DNS query data, such as query timing, frequency, sequence patterns, and spectral characteristics. By taking out only the most discriminative features needed for detection rather than analyzing all possible aspects of DNS traffic, the system achieves high reliability with controlled complexity.
3Measurement precision
If DNS query pattern analysis is performed on all domains, then detection of malicious domains is improved, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by performing full spectral analysis only on domains that exhibit suspicious baseline characteristics, rather than analyzing all DNS queries with equal depth. The system uses a two-stage approach: initial filtering based on simple criteria, followed by detailed pattern analysis only for potentially malicious domains. This reduces overall processing time while maintaining detection accuracy for malicious domains.
Solution Approach 2:
The patent segments the detection process into multiple stages: initial DNS query collection, baseline pattern establishment, spectral analysis, and final classification. By dividing the analysis into segments that can be performed at different depths and priorities, the system achieves high detection accuracy for malicious domains while minimizing total processing time through efficient resource allocation at each stage.
Data Source
AI summary
Malicious domain finding using DNS query pattern analysis is disclosed. A first DNS query signature and a second DNS query signature are generated, using a set of DNS query records. The first and second DNS query signatures are compared, and the second DNS query signature is identified as malicious based on a detected match between the first and second DNS query signatures.