Hostname Suspicion Detection via N-gram Entropy Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
It is challenging to automatically and programmatically determine whether a hostname is malicious, particularly those generated by botnets using domain generation algorithms (DGAs) for malware, spam, phishing, or DDoS attacks, due to the large number of websites and ease of registering new ones on the Internet.
Innovation Solution
A system implements a 2-phase process to identify suspicious hostnames by filtering input strings based on n-gram entropy and recency, and then uses a rule-based engine to evaluate topologically or algorithmically related hostnames, applying 'guilt by induction' rules to determine if they are 'bad' strings, which can be recursively examined to build a set of suspicious hostnames.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a system analyzes all hostnames to identify malicious ones, then detection completeness improves, but processing time and computational resources increase significantly
Solution Approach 1:
The patent segments the hostname analysis process into two distinct phases: Phase 1 filters hostnames using n-gram entropy to identify suspicious candidates, and Phase 2 applies guilt-by-induction rules to confirm malicious hostnames. This segmentation allows the system to process only a subset of hostnames in detail, reducing overall processing time while maintaining detection completeness.
Solution Approach 2:
The patent performs preliminary filtering using n-gram entropy calculation before conducting the more computationally intensive guilt-by-induction analysis. By pre-identifying suspicious hostnames based on their entropy characteristics, the system prepares a reduced set of candidates for further analysis, thereby reducing total processing time while ensuring no malicious hostnames are missed.
2Measurement precision
If the system uses complex analysis methods to accurately identify malicious hostnames, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent divides the detection system into two modular phases with distinct functions: Phase 1 uses n-gram entropy filtering, and Phase 2 uses guilt-by-induction rule matching. Each phase is independently implementable and can be optimized separately, reducing overall system complexity while maintaining high detection accuracy through the combination of both phases.
Solution Approach 2:
The patent introduces an intermediary filtering mechanism (n-gram entropy calculation) between the input hostname set and the final malicious hostname identification. This intermediary step reduces the number of hostnames that require complex guilt-by-induction analysis, thereby reducing system complexity while preserving detection accuracy.
3Reliability
If the system processes a large input set of hostnames, then detection coverage improves, but processing efficiency decreases
Solution Approach 1:
The patent segments the processing workflow into a coarse filtering phase (n-gram entropy) and a fine analysis phase (guilt-by-induction rules). This segmentation enables the system to efficiently handle large input sets by quickly eliminating non-suspicious hostnames in Phase 1, thereby improving processing efficiency while maintaining comprehensive detection coverage through Phase 2 analysis of candidates.
Solution Approach 2:
The patent applies partial action by performing complete guilt-by-induction analysis only on hostnames that pass the n-gram entropy filter, rather than analyzing all input hostnames. This selective approach improves processing efficiency by avoiding unnecessary complex analysis on benign hostnames, while detection coverage is maintained because the filtering phase ensures all potentially malicious hostnames are included in the candidate set.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method includes receiving a set of strings and applying one or more filters to generate a subset of strings that are determined to correspond to strings of interest. The method also includes retrieving domain name system (DNS) information associated with a first string of the subset. The method includes executing a rule-based engine to determine, based on application of one or more rules to the DNS information, whether to add the first string to a set of suspicious hostnames.