Malware Domain Generation Analysis via Temporal Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware originators exploit dynamic domain name generation methods to evade detection, making it difficult for protective software to identify command and control servers, thereby allowing malware to continue spreading and compromising computer systems.
Innovation Solution
A system and method that execute malware in a controlled environment at different temporal input values to generate and compare sets of domain names, identifying malware enabled by automatically generated domain names by analyzing the overlap between these sets, and storing the generated domain names for potential blacklisting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If protective software uses traditional domain name identification methods, then it can identify C&C servers, but malware using dynamic domain generation can evade detection
Solution Approach 1:
The system performs preliminary execution of the malware sample in a controlled environment before deployment, generating and analyzing domain names in advance. By executing the malware at different temporal input values and comparing the generated domain names, the system identifies DGA patterns proactively, creating a blacklist of malicious domains before they are used in actual attacks.
Solution Approach 2:
The system creates a copy of the malware sample in a controlled sandbox environment to safely analyze its behavior. By copying and executing the malware in isolation, the system can observe domain generation patterns without risking actual system compromise, then use this knowledge to protect the real system.
2Adaptability or versatility
If malware uses dynamically changing domain names, then it can avoid identification, but this increases the complexity of protective software detection
Solution Approach 1:
The system changes the temporal input parameter when executing the malware sample, running it at multiple different times to generate sets of domain names. By comparing these sets and analyzing overlaps, the system identifies DGA patterns without needing to track every individual domain name, simplifying the detection approach despite malware adaptability.
3Measurement precision
If the system executes malware at multiple temporal values to generate domain name sets, then it can identify DGA patterns, but this increases analysis time
Solution Approach 1:
The system performs a limited number of malware executions at different temporal values rather than exhaustive analysis. By comparing a small set of generated domain names across multiple executions and looking for overlap patterns, the system achieves sufficient detection accuracy without excessive time investment, balancing precision with efficiency.
Data Source
AI summary
Computerized methods and systems identify malware enabled by automatically generated domain names. An agent executes a malware, in a controlled environment, at a first temporal input value and a second temporal input value. A first set of domain names is generated in response to the execution at the first temporal input value. A second set of domain names is generated in response to the execution at the second temporal input value. The agent compares the first set of domain names with the second set of domain names to produce a comparison output metric.