Endpoint DNS Query Attribution for DGA Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting and preventing malware communication using Domain Generation Algorithms (DGAs) are ineffective as they rely on network-level analysis, fail to identify the specific program or code component originating the request, and can be evaded by attackers using existing popular services, making it difficult to block or control rendezvous locations.
Innovation Solution
Implementing endpoint-based software that monitors program requests using Windows ETW to attribute DNS queries to specific programs and services, detecting failed access attempts to non-existent domains or services, and utilizing algorithms like RGA to identify patterns of failed attempts indicative of malware activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network-level analysis is used to detect DGA malware, then detection coverage is achieved, but detection accuracy deteriorates due to inability to identify specific program origins
Solution Approach 1:
The patent introduces an intermediary component (ETW instrumentation layer) between the network analysis system and the DNS query sources. This intermediary instruments programs to capture detailed information about DNS query origins, including which specific program or library made the query and what parameters were used. This resolves the contradiction by providing precise program-level attribution without requiring complete system redesign.
2Measurement precision
If endpoint-based monitoring software is installed to attribute DNS queries to specific programs, then detection accuracy improves, but device complexity increases
Solution Approach 1:
The patent replaces complex manual instrumentation mechanisms with automated dynamic instrumentation using ETW. Instead of requiring manual configuration and tracking of DNS queries through complex system calls, the system uses ETW providers and listeners to automatically capture program identity, call stack information, and query parameters. This substitution reduces the effective complexity while maintaining high attribution precision.
3Object-affected harmful factors
If attackers use existing popular services for malware communication, then malware evasion capability improves, but detectability deteriorates
Solution Approach 1:
The patent applies local quality analysis by examining specific characteristics of DNS queries made to popular services. Instead of treating all queries to legitimate services uniformly, the system analyzes local properties such as query timing patterns, parameter structures, calling program identities, and frequency distributions. This enables detection of malicious use of legitimate services by identifying anomalous local characteristics that differ from normal usage patterns.
4Reliability
If RGA algorithms are used to identify patterns of failed access attempts, then malware detection capability improves, but false positive rate worsens
Solution Approach 1:
The patent applies partial action by implementing a multi-stage detection approach. The RGA algorithm first identifies potential malware candidates through patterns of failed DNS queries, but then applies additional filtering criteria before final detection. This includes verifying program identity, checking parameter patterns, and comparing against baseline behavior. This partial application of detection criteria reduces false positives while maintaining high malware detection capability.
Data Source
AI summary
A method, computer program product, system and apparatus for the prevention of RGA and DGA malware over an existing internet service is disclosed. The invention exploits the fact that when malware rapidly attempts to access many contact points, a malware is likely to need several attempts to find a current server. Software is installed on the individual endpoints in a network of internet services. The software monitors the websites or services and collects information about access attempts. The invention detects a series of failed attempts by the malware to access the service/website. These attempts can be accrued by being temporally linked (e.g., many attempts in a short time, many attempts consecutively), conceptually linked (e.g., similar addresses, similar attempts across multiple machines or time scales), higher than normal prevalence or other methods. The invention provides an indication of a malware attempt if enough failed attempts have accrued.