DNS Stream Classification for Dictionary-Based DGA Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing approaches fail to accurately and efficiently identify Domain Generation Algorithm (DGA) behavior on a network, particularly for detecting dictionary-based DGA traffic generated by malware, and determine if a host device sending DNS queries to non-existent domains is infected with DGA malware.

Innovation Solution

A system and method for detecting dictionary-based DGA traffic using a per domain dictionary DGA classifier, which includes deep learning and machine learning techniques to classify DNS streams, filter candidate DGA domains, and perform actions based on matches with monitored DNS requests, utilizing sinkholing and alert generation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional firewall rules are used to filter network traffic, then basic unauthorized access protection is provided, but DGA malware communication cannot be detected

Engineering Contradiction:

ImproveDGA detection accuracyVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a dictionary as an intermediary component that stores known DGA-generated domain names. The system mediates between the firewall and the complex machine learning analysis by first checking against this dictionary, allowing efficient detection of known DGA domains without requiring full deep learning model execution for every query.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary classification using lighter-weight machine learning models before applying full deep learning analysis. It also pre-populates the dictionary with known DGA domains from training data, enabling faster subsequent detection without re-running complex training procedures.

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If deep learning classifiers are applied to all DNS queries, then high detection accuracy is achieved, but processing speed decreases

Engineering Contradiction:

ImproveDGA detection precisionVSAvoidDNS query processing speed

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The detection system is segmented into multiple processing stages: a fast dictionary lookup stage for immediate recognition of known DGA domains, a medium-weight machine learning classification stage for suspicious domains, and a deep learning analysis stage for ambiguous cases. This segmentation allows most queries to be resolved quickly while maintaining high precision for malicious domains.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different processing qualities are applied to different DNS queries based on their characteristics. Common or obviously benign queries receive minimal processing, while suspicious queries undergo more rigorous analysis. The system dynamically adjusts the level of inspection applied to each query based on local conditions.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12621265B2System and method for detecting dictionary-based DGA traffic

Publication Date: 2026.05.05 PALO ALTO NETWORKS INC

AI summary

A system and method for detecting dictionary-based DGA traffic is provided. A domain name system (DNS) stream is received. The DNS stream is classified using a per domain dictionary domain generation algorithm (DGA) classifier to generate candidate dictionary DGA domains with cluster information. The candidate dictionary DGA domains are filtered to generate a set of dictionary DGA domains. An action is performed based on a match with a monitored domain name of a monitored DNS request and a dictionary DGA domain of the set of dictionary DGA domains.