Malware Domain Detection via Passive DNS Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antimalware techniques struggle to detect malware that uses polymorphic packers and custom techniques to evade detection, particularly failing to identify new variants and members of known malware families, and face challenges in accurately identifying malicious domains through DNS analysis.
Innovation Solution
The use of clustering with malware source information, combined with passive DNS techniques, to associate malware samples with their sources and domains, generating clusters and reputation scores to identify malware domains and families, and distributing new signatures or rules for zero-day threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antimalware techniques are used, then detection of known malware is possible, but detection of new variants and polymorphic malware fails
Solution Approach 1:
The system performs preliminary clustering of malware samples based on their domain associations before actual detection. By pre-grouping malware into families using passive DNS data and clustering algorithms, the system establishes a foundation that enables rapid identification of new variants without requiring re-analysis of entire malware databases, thus improving both reliability and adaptability
Solution Approach 2:
The patent introduces passive DNS data and domain clustering as an intermediary layer between traditional malware detection and new variant identification. This intermediary approach allows the system to detect relationships between malware samples through their domain associations, enabling detection of polymorphic malware that would otherwise evade traditional signature-based detection
2Measurement precision
If DNS analysis is used to identify malicious domains, then domain detection is possible, but accuracy is reduced due to evasion techniques
Solution Approach 1:
The system implements feedback mechanisms where detected malicious domains are fed back into the clustering algorithm to refine future detections. By continuously updating cluster associations based on new detections and passive DNS data, the system improves its ability to accurately identify malicious domains while adapting to new evasion techniques
Solution Approach 2:
The patent uses domain clustering as an intermediary approach to overcome direct DNS analysis limitations. Instead of relying solely on DNS query analysis which can be evaded, the system mediates through cluster associations built from passive DNS data, allowing indirect identification of malicious domains through their relationships with known malicious clusters
3Reliability
If clustering with malware source information is used, then malware family identification improves, but system complexity increases
Solution Approach 1:
The patent segments the malware analysis problem into distinct components: passive DNS data collection, clustering algorithm processing, and detection output generation. By dividing the system into these modular segments, the complexity is managed through clear separation of concerns while maintaining high identification accuracy through specialized processing in each segment
Data Source
AI summary
Techniques for malware domain detection using passive Domain Name Service (DNS) are disclosed. In some embodiments, malware domain detection using passive DNS includes generating a malware association graph that associates a plurality of malware samples with malware source information, in which the malware source information includes a first domain; generating a reputation score for the first domain using the malware association graph and passive DNS information; and determining whether the first domain is a malware domain based on the reputation score for the first domain.