Malware Domain Name Classification via Host-Network Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems are ineffective in detecting and preventing malicious botnets, particularly those using Domain Name Generation Algorithms (DGAs) to establish network connections, which evade detection by using dynamically generated random domain names.
Innovation Solution
A combined host-based and network-based analysis approach that classifies executable files and network connections, utilizing whitelists and blacklists, and calculates a randomness score for domain names to identify potentially malicious connections, thereby detecting and preventing botnet establishment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Domain Name Generation Algorithms (DGAs) are used to dynamically generate random domain names, then botnets can establish network connections and evade detection, but detection accuracy decreases and false positives increase
Solution Approach 1:
The system segments the analysis process into distinct phases: executable file analysis phase and network connection analysis phase. The executable file is analyzed first to determine its disposition (malicious, safe, or unknown), and only then is the network connection analysis performed based on that disposition. This segmentation allows the system to handle the complexity of DGA detection by breaking it into manageable steps, improving reliability without overwhelming system complexity.
Solution Approach 2:
The system performs preliminary analysis of the executable file before analyzing the network connection. By determining the disposition of the executable file first (whether it is malicious, safe, or unknown), the system prepares the groundwork for subsequent network connection analysis. This preliminary action reduces false positives by only performing detailed network analysis when the executable disposition suggests potential maliciousness, thereby improving detection accuracy while managing system resources efficiently.
2Measurement precision
If comprehensive analysis of executable files and network connections is performed, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system applies partial action by performing comprehensive executable file analysis on all files, but only performing network connection analysis when the executable disposition indicates potential maliciousness (malicious or unknown categories). This selective approach maintains high detection precision for malicious connections while reducing unnecessary processing time for safe files, effectively balancing measurement precision with time efficiency.
Solution Approach 2:
By performing executable file analysis as a preliminary step before network connection analysis, the system prepares classification results that guide subsequent analysis depth. Files classified as safe during executable analysis skip detailed network analysis, reducing processing time. Files classified as malicious or unknown undergo full network analysis, maintaining high detection precision. This preliminary classification approach optimizes the balance between precision and processing time.
3Reliability
If randomness score calculation is used for domain names beyond threshold length, then false positives are reduced, but computational overhead increases
Solution Approach 1:
The system applies local quality by calculating randomness scores only for domain names that meet specific local conditions: the domain name length must exceed a predetermined threshold. This localized application of randomness score calculation focuses computational energy only on potentially suspicious cases (long domain names that may be DGA-generated), rather than uniformly analyzing all domain names. This approach maintains high classification reliability for suspicious cases while significantly reducing overall computational energy consumption.
Solution Approach 2:
The system changes the parameter of domain name analysis by introducing a length threshold parameter. Domain names below this threshold are automatically classified as safe without randomness calculation, while those above the threshold undergo randomness score calculation. This parameter-based filtering approach ensures that computational energy is spent only where needed (on potentially malicious long domain names), maintaining reliability while optimizing energy usage.
Data Source
AI summary
Techniques are presented herein that combine a host-based analysis of an executable file on a host computer with a network-based analysis, i.e., an analysis of domain names to detect malware generated domain names that are used by the malicious executable files to establish malicious network connections. A server receives information from a host computer about an executable file that, when executed on the host computer, initiates a network connection. The server also receives information about the network connection itself. The server analyzes the information about the executable file to determine whether the executable file has a malicious disposition. Depending on a disposition of the executable file, the server analyzes the information about the network connection and determines whether the network connection is malicious.