Automated Domain Name Classification for Malware Threat Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Threat intelligence researchers face challenges in efficiently classifying domain names resolved by malware due to protection mechanisms in Dynamic DNS systems that block IP resolution requests, requiring improved automated classification techniques.
Innovation Solution
The implementation of an asynchronous DNS resolution system that classifies domain names by parsing full domain names into top-level and domain components, utilizing dynamic and trusted domain tables to categorize domains, and storing classifications with time-to-live attributes, thereby avoiding IP blocking and enabling efficient domain type classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If frequent access to Dynamic DNS system is performed for domain resolution, then domain classification efficiency is improved, but IP blocking by DNS servers occurs
Solution Approach 1:
The system performs preliminary domain classification by parsing domain names into components and checking against domain tables before making DNS resolution requests. This preliminary filtering reduces the frequency and volume of DNS requests, preventing IP blocking while maintaining classification efficiency.
Solution Approach 2:
The patent introduces an intermediary classification system that sits between the malware analysis and the Dynamic DNS system. This intermediary parses domains, checks domain tables, and only makes necessary DNS requests, acting as a buffer that protects against IP blocking while enabling efficient domain classification.
2Measurement precision
If manual domain name resolution is performed by threat intelligence researchers, then classification accuracy is improved, but time consumption increases
Solution Approach 1:
The system implements automated self-service domain classification by parsing domain names into components (top-level domain, domain, subdomain) and automatically checking against domain tables. This eliminates manual researcher intervention while maintaining accurate classification through systematic parsing and matching algorithms.
Solution Approach 2:
The patent replaces the mechanical manual process of domain resolution with an automated computational system that parses domain names, queries domain tables, and classifies domains automatically. This substitution maintains classification accuracy through systematic algorithms while eliminating time-consuming manual operations.
3Speed
If domain names are parsed into components and classified using domain tables, then classification speed is improved, but system complexity increases
Solution Approach 1:
The system segments domain names into distinct components (top-level domain, domain, subdomain) and maintains separate domain tables for different classification categories. This segmentation enables faster classification by allowing parallel table lookups while organizing system complexity into manageable, modular components.
Data Source
AI summary
Techniques are provided for automated classification of domain names resolved by malware. An exemplary method comprises obtaining a domain name included in malware domain resolution requests; obtaining a domain table identifying a plurality of known domains; obtaining a dynamic domain table identifying a plurality of dynamic Domain Name System domains; parsing a full domain name associated with the domain name from the malware domain resolution requests into a Top Level Domain and a Domain; classifying the domain from the malware domain resolution requests name as a dynamic Domain Name System domain if the Top Level Domain and the Domain are found in the dynamic domain table; and storing the classification of the domain name from the malware domain resolution requests as the dynamic Domain Name System domain in the domain table with a complete domain of the domain, a current date and time and a Time-To-Live attribute of the domain from a response of the Domain Name System.