Malware Protection via Active Learning Domain Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern malware uses domain generating algorithms (DGAs) to dynamically change command and control server locations, making it difficult for security researchers and law-enforcement to detect and mitigate malware activity, as the large number of generated domain names complicates identification and disruption of communication channels.
Innovation Solution
A computer-implemented method that trains a classifier to differentiate between legitimate and illegitimate domain names generated by DGAs, using active learning techniques to retrain the classifier based on DNS query outcomes and additional information, allowing for the identification and mitigation of malware activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a fixed address for the command and control server is used, then the malware operation is easy to identify and disrupt, but the attacker cannot dynamically change the server location to maintain ongoing control
Solution Approach 1:
The system performs preliminary DNS queries to resolve domain names generated by the DGA before blocking them. By proactively querying DNS for domains generated by the malware's DGA, the system identifies legitimate-looking domains that are actually used for malicious command and control communication, enabling early detection and blocking before the malware can establish communication channels.
Solution Approach 2:
The system implements feedback by monitoring DNS query outcomes and using this information to identify and block malicious domains. When a DNS query returns a positive result for a domain generated by a suspected DGA, the system feeds this information back into the blocking mechanism, dynamically updating the set of blocked domains based on real-time observations of malware behavior.
2Adaptability or versatility
If a large number of domain names are generated by the DGA, then the attacker has more locations to deploy the command and control server, but the complexity of identifying and managing these domains increases
Solution Approach 1:
The system segments the large set of generated domain names by processing them in batches and categorizing them based on DNS query outcomes. Instead of attempting to analyze all possible domains simultaneously, the system divides the domain generation process into manageable segments, querying DNS for each domain and separating legitimate from malicious domains based on the results, thereby reducing the complexity of managing the large number of potential command and control locations.
3Measurement precision
If DNS queries are performed for all generated domain names, then accurate identification of malicious domains is achieved, but the time and computational resources required increase significantly
Solution Approach 1:
The system performs DNS queries for all domain names generated by the DGA, which is an excessive action compared to only querying suspected malicious domains. By querying all generated domains, the system ensures complete and accurate identification of malicious command and control locations, accepting the additional time and computational cost as necessary to achieve high precision in detecting malware communication channels.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Malware Protection A computer implemented method, computer system and computer program are provided for protecting against malware. The method trains a classifier to classify a domain name as being either legitimate or illegitimate, wherein a classification of illegitimate indicates that the domain name was generated by a Domain Generation Algorithm used to generate domain names for malware. The method retrains the classifier using an active learning technique by: using the classifier to determine a respective classification of each domain name in a set of domain names; performing a respective domain name system, DNS, query for each domain name in the set; labelling one or more domain names in the set based on the classification of those domain names and the outcome of the respective DNS queries for those domain names; and using training data comprising the labelled one or more domain names to retrain the classifier. The method uses the classifier to classify a domain name that is the subject of a DNS query from a computer system in a network. The method takes one or more predetermined actions for mitigating or preventing the activity of the malware in response to the domain name being classified as illegitimate.