In-Line Algorithmically Generated Domain Detection with Markov Chains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware authors use sophisticated techniques to obfuscate domain generation algorithms, making it difficult for security companies to detect algorithmically generated domains (AGDs) used by malware for communication with command and control servers, thereby complicating efforts to mitigate malware harm.
Innovation Solution
Implement a system that includes a DNS module and a security platform utilizing a Markov Chain analyzer and historical data to identify AGDs by analyzing character distribution probabilities and resolution statistics, reducing false positives through additional historical checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security companies attempt to identify and block malware using traditional methods, then some malware can be detected, but malware authors use increasingly sophisticated obfuscation techniques that evade detection
Solution Approach 1:
The patent replaces traditional mechanical analysis methods (manual reverse engineering, static code analysis) with a probabilistic statistical system using Markov Chains. Instead of examining the actual domain generation algorithm mechanics, the system substitutes a mathematical model that predicts character transition probabilities, enabling detection without directly analyzing the obfuscated malware code.
Solution Approach 2:
The patent changes the detection parameters from examining domain names directly to analyzing character distribution probabilities and transition patterns. By transforming the detection approach from content-based to statistical-parameter-based, the system can identify algorithmically generated domains regardless of the specific obfuscation techniques used.
2Measurement precision
If security companies perform extensive reverse engineering of domain generation algorithms, then detection accuracy improves, but time and computational resources are significantly consumed
Solution Approach 1:
The patent performs preliminary action by pre-computing Markov Chain probability models for both benign and algorithmically generated domains. These pre-computed statistical profiles are stored and ready for immediate comparison against new domains, eliminating the need for time-consuming reverse engineering at detection time.
Solution Approach 2:
The patent creates simplified statistical copies (Markov Chain models) of domain generation patterns instead of working with the actual complex algorithms. These probabilistic copies capture the essential characteristics of algorithmically generated domains without requiring analysis of the underlying generation logic, dramatically reducing detection time.
3Object-affected harmful factors
If the system blocks all suspicious domains, then malware communication is prevented, but false positives increase and legitimate domains are blocked
Solution Approach 1:
The patent implements feedback by comparing the observed character transition probabilities of a domain against the pre-computed Markov Chain models for both benign and malicious domains. This feedback mechanism allows the system to dynamically adjust its classification based on statistical similarity, reducing false positives while maintaining effective malware blocking.
Data Source
AI summary
Detection of algorithmically generated domains is disclosed. A DNS query is received. Markov Chain analysis is performed on a domain included in the received query. A determination of whether the received query implicates an algorithmically generated domain is made based at least in part on a result of the Markov Chain analysis.