Query Classification for Detecting DGA-Based Botnet Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for detecting malicious network activity, particularly from botnets, struggle to identify 'unknown unknowns' without known signatures, allowing command and control devices to evade detection through Domain Generation Algorithms (DGAs) that generate legitimate-looking entity identifiers.
Innovation Solution
An intermediary system uses machine learning models to analyze and classify entity identifier queries based on features such as contiguous sequences of characters and frequency rankings, identifying illegitimate queries generated by DGAs, and determines the originating devices' profiles to perform remedial actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used to identify malicious network activity, then known malicious patterns can be detected, but unknown unknowns (new malware variants using DGAs) cannot be detected
Solution Approach 1:
The patent replaces traditional signature-based mechanical detection with machine learning-based anomaly detection. The system uses ML models to analyze entity identifier queries and classify them as legitimate or malicious based on learned patterns, enabling detection of unknown malware variants without relying on pre-existing signatures.
Solution Approach 2:
The system changes the detection parameters from fixed signatures to dynamic machine learning models that continuously adapt. By training models on feature patterns (contiguous character sequences, frequency rankings) and updating them with new data, the system can detect evolving malware techniques including DGA-generated domains.
2Adaptability or versatility
If machine learning models are used to classify entity identifier queries, then unknown unknowns can be detected, but system complexity increases
Solution Approach 1:
The patent segments the detection system into distinct functional components: feature extraction module (identifying contiguous character sequences), classification module (ML-based legitimacy determination), and response module (remedial actions). This segmentation makes the complex ML system manageable and deployable while maintaining high detection capability.
Solution Approach 2:
The system introduces an intermediary classification layer between network traffic monitoring and security response. The ML-based classification module acts as a mediator that processes entity identifier queries, determines legitimacy, and triggers appropriate responses, simplifying the overall system architecture while enabling sophisticated detection.
3Measurement precision
If feature extraction based on contiguous character sequences is used, then DGA-generated identifiers can be identified, but processing time increases
Solution Approach 1:
The system performs preliminary feature extraction and classification in advance, analyzing entity identifier queries before they are executed. By pre-processing and classifying queries using ML models that consider contiguous character sequences and frequency rankings, the system can quickly identify malicious activity without requiring time-consuming deep analysis during execution.
Data Source
AI summary
Described herein are methods, systems, and apparatuses for query analysis and classification. A plurality of entity identifier queries associated with a plurality of entity identifiers may be received and classified as being legitimate or illegitimate. Illegitimate entity identifier queries may be associated with originating devices that are infected with malware. The originating devices may have sent the illegitimate entity identifier queries in an attempt to communicate with a command and control server(s) of a botnet. Such originating devices may be identified and one or more remedial actions may be performed.