DNS Query Monitoring for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security technologies fail to detect malicious code effectively when malware uses DNS as a layer of indirection with short TTL, causing C2 servers to resolve to localhost, thereby suppressing traffic that would otherwise be analyzed by security devices.
Innovation Solution
A method is implemented to identify queries to a domain name service that resolve to a local address, trace the process originating the query, and designate it as infected, blocking subsequent queries based on relationships with the identified fully qualified domain name and IP address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware uses DNS with short TTL to resolve C2 server addresses, then the malware can dynamically update C2 server identities and suppress traffic analysis, but security devices cannot detect or analyze the malicious traffic
Solution Approach 1:
The patent inverts the detection approach by monitoring DNS query responses instead of analyzing C2 traffic directly. By detecting when DNS queries return localhost addresses (indicating botnet communication patterns), the system can identify infected processes before they establish C2 connections, thus detecting malware that uses short TTL DNS updates without being able to analyze the actual suppressed traffic
Solution Approach 2:
The patent uses DNS query monitoring as an intermediary detection mechanism. Instead of directly observing C2 traffic which is suppressed through localhost resolution, the system monitors the DNS layer as an intermediary point where malicious patterns (queries resolving to localhost) reveal the presence of infected processes attempting C2 communication
2Measurement precision
If DNS queries are monitored to detect malicious activity, then infected processes can be identified, but false positives may occur from legitimate localhost usage
Solution Approach 1:
The patent applies dynamic monitoring by tracking the frequency and patterns of DNS queries resolving to localhost over time. Instead of static detection rules, the system dynamically identifies processes that repeatedly query DNS and receive localhost responses, establishing a behavioral pattern that distinguishes malicious botnet activity from legitimate localhost usage
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring DNS query patterns and adjusting detection thresholds based on observed behavior. When a process exhibits suspicious DNS query patterns (multiple queries resolving to localhost), the system provides feedback by blocking subsequent queries and alerting security personnel, while allowing legitimate traffic to continue unaffected
3Object-affected harmful factors
If all DNS queries resolving to localhost are blocked, then malicious C2 traffic is prevented, but legitimate local service communications are disrupted
Solution Approach 1:
The patent applies preliminary action by monitoring and identifying suspicious DNS query patterns before implementing blocking. The system first detects processes that repeatedly query DNS and receive localhost responses, establishes them as infected, and only then blocks their subsequent queries. This preliminary identification phase ensures that only confirmed malicious traffic is blocked, preserving legitimate local service communications
Data Source
AI summary
Techniques for detecting malicious code are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting malicious code comprising the steps of identifying a query to a domain name service that resolves to a local address; identifying the process that originated the identified query; and designating the identified process as infected based on identifying the process as having originated the query that resolved to a local address.