DNS Query Analytics for Malware C&C Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face challenges in detecting command and control (C&C) behavior of malware, particularly due to its evolving nature and use of DNS messages, which are hidden within legitimate queries, making it difficult to identify and prevent botnet communication.
Innovation Solution
A method and system for detecting C&C behavior using self-calibrated entity profiles that analyze DNS query patterns, calculate real-time scores, and employ belief propagation techniques to identify suspicious activity, while also considering external risk quantifications and aggregating data across multiple monitoring systems to improve detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network administrators block all suspicious DNS queries to prevent malware C&C communication, then security protection is improved, but legitimate Internet access is severely restricted
Solution Approach 1:
The system changes the parameters of DNS query analysis by examining multiple attributes simultaneously (query frequency, destination diversity, response patterns, timing characteristics) rather than relying on simple blocklists. This enables nuanced differentiation between legitimate and malicious traffic, maintaining security while preserving legitimate access.
Solution Approach 2:
The patent replaces mechanical blocking mechanisms with adaptive analytics that use belief propagation and entity profiling. Instead of predetermined rules, the system dynamically adjusts detection parameters based on observed behavior patterns, reducing false positives while maintaining security.
2Measurement precision
If traditional signature-based detection methods are used to identify malware, then known threats can be detected, but evolving and unknown malware variants cannot be detected
Solution Approach 1:
The system implements dynamic entity profiles that continuously adapt to new threat patterns. Rather than static signatures, the profiles evolve by incorporating new observation data, allowing the system to detect both known and emerging malware variants through behavioral analysis.
Solution Approach 2:
The belief propagation mechanism enables the system to self-calibrate by automatically learning from observed DNS query patterns. The entity profiles self-update based on collective intelligence from multiple monitoring systems, eliminating the need for manual signature updates while maintaining high detection accuracy.
3Measurement precision
If comprehensive real-time analysis of all DNS queries is performed, then detection accuracy is improved, but system complexity and computational resources increase
Solution Approach 1:
The system segments the analysis by creating individual entity profiles for different DNS query characteristics (source IP, destination domain, query type, timing patterns). This modular approach distributes computational complexity across multiple independent profile analyses rather than requiring monolithic processing of all queries simultaneously.
Solution Approach 2:
Multiple monitoring systems are merged into a consortium that shares entity profile data and collective intelligence. This distributes the computational burden across multiple systems while improving detection accuracy through aggregated data, reducing the complexity burden on any single system.
4Ease of operation
If multiple monitoring systems operate independently, then each system can function autonomously, but detection accuracy and coverage are limited
Solution Approach 1:
The entity profiles serve multiple functions simultaneously: they act as detection signatures, behavioral baselines, and sharing artifacts across the consortium. This multi-functionality allows systems to maintain operational autonomy while contributing to and benefiting from collective intelligence, improving detection accuracy without sacrificing independence.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.